MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e07bde93d122c059f5b159267f273d05ff8ac8bec540f3ae3bc7c8cd32f1fc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e07bde93d122c059f5b159267f273d05ff8ac8bec540f3ae3bc7c8cd32f1fc7
SHA3-384 hash: 8266c2bd0cedaf5a991f7ca5766b5dac7f5446aae912ee503c9df413bf4d4364b0188c9713a13f50e703a9e43fb09842
SHA1 hash: dbbef61d1dea3d75d817bde033bbb46547064303
MD5 hash: 30942ca86a84fe502f5fd7d82ad9fcca
humanhash: comet-lake-august-minnesota
File name:30942ca86a84fe502f5fd7d82ad9fcca.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'435'136 bytes
First seen:2021-04-21 13:31:03 UTC
Last seen:2021-04-21 15:00:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:u4xmQb2/RRRRRPTmjsAko8ftVRln5+on7QOOors+DfFU:u4GRRRRRLmtkdRR5+I0OOor/DfFU
Threatray 1'793 similar samples on MalwareBazaar
TLSH C065AE1EE74E7704E3E9873FC1D594B8502ACD129A09FA3E69E472BD4AF17DD1800A87
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore C2:
79.134.225.50:83

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
79.134.225.50:83 https://threatfox.abuse.ch/ioc/9210/

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
30942ca86a84fe502f5fd7d82ad9fcca.exe
Verdict:
Malicious activity
Analysis date:
2021-04-21 13:35:49 UTC
Tags:
rat nanocore
Link:
https://app.any.run/tasks/3807e8aa-edd5-46a9-9231-109453b5de76

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/142134/
Detection(s):
SecuriteInfo.com.Malware.AI.4275721012.30437.21001.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e07bde93d122c059f5b159267f273d05ff8ac8bec540f3ae3bc7c8cd32f1fc7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 13:36:32 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pyd332j5ciwalh23cwjgp4tt2bp7rlel5rka6oxdxr6izuzpd7dq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
1ddce9c11a9b35eb6d55006504b47ab27bcef3edc7747c49d4573712a5a3b275
NanoCore
287597fcffd11298b757ac806606000d8dd4c3c2641891c1932a1e76348d9922
NanoCore
7bf28130b0141b6ae9b4b4bb71c7a300d9025944e08db4206eff5d0bc8a3b264
NanoCore
8192d560e89e235f4734cf4ad8fa3a9a91abd7eb83b589c4d471efc5d6361f1d
NanoCore
9652253cdacd325a73a4850f3a0ddd64531dc8f52f29db132e0a589898b93571
NanoCore
9822b3db3d4039f26ee8f6f690dcca63094904607a3ec076a4e73fd0aa919103
NanoCore
b52d51a3fcc992ee839f94f07d7ac0bcdeccc5c1a3de24b82357a01ee9bf37c1
NanoCore
c92c63658f161a639482f7e150303a4c6648f9186a8601fff6d14af694815895
NanoCore
f53725b61d137ea3e8fa69467ed2406c4f73496c92353dc3364cc9035c8ba87d
NanoCore
fe1ea584b7d72f50410d442b8aa1e35daf12c93e72a06cef84899c9767705563
NanoCore
+ 1'783 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210421-h8dag7q57a/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
NanoCore
Malware Config
C2 Extraction:
79.134.225.50:83
nassiru1166.webhop.me:83
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e07bde93d122c059f5b159267f273d05ff8ac8bec540f3ae3bc7c8cd32f1fc7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NanoCore

Executable exe 7e07bde93d122c059f5b159267f273d05ff8ac8bec540f3ae3bc7c8cd32f1fc7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1143918/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/142134/
  
URLhaus
https://urlhaus.abuse.ch/url/1143921/

Comments