MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fc1a736c594f6932e35c60e99b984b93280b68a48989683839ac1f25fe17d97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	7fc1a736c594f6932e35c60e99b984b93280b68a48989683839ac1f25fe17d97
SHA3-384 hash:	758c158ffd5b4ac1a3d8052c762e2fd275c42e988ec0bcf944b05c7dc0ff8a6bfb924621aa3b63c7fad77a7ac02dd4d9
SHA1 hash:	bd80b6c6e9d6134a4be8e69cd8dd644bbc57dfcc
MD5 hash:	0b9fffb2575af254598a1921a40c155c
humanhash:	bulldog-solar-football-low
File name:	FT20200504 104835457 EMIRATE.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	648'192 bytes
First seen:	2020-05-04 17:45:03 UTC
Last seen:	2020-05-04 18:55:26 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'616 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:BJ6NAcIAfLISU4mvkGdRv+s5QKvUB+D4YZVjaR0/cVRFhuZ:iNAs/U4mvnNvvUB+sIjaL0Z
Threatray	1'227 similar samples on MalwareBazaar
TLSH	DAD4D039DE184B36D962C338C5C1D43BB1544D02F6AEDB4552C26F9B3533282AAA3F6D
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: server.ipj3.com
Sending IP: 85.187.151.45
From: Shabi Utter <shabi@gol.com>
Subject: Payment Advice Ref: FT20200504: TT75
Attachment: FT20200504 104835457 EMIRATE.zip (contains "FT20200504 104835457 EMIRATE.exe")

NanoCore RAT C2:
chaya.ddns.net:1960 (185.140.53.208)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.KillProc2.10268.20582.31221.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Nanobot

Status:

Malicious

First seen:

2020-05-04 01:03:48 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 30 (83.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=p7a2onwfst3jglrvyyhjtomexezibnukjcmjna4dtla7ex7bpwlq._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

266c0f3b1cf78040080fce2037544112b77d23b25753c714d6390c2f705a3c34

NanoCore

34f1b02bdccebe61deb518957acd32c9a64ce358102db3be15ed7d46f9945004

NanoCore

37bddf42525de673f8c88355875c5bed4035d5c5100ebece7c3aae162d3ba68f

NanoCore

49734ef67be2f2a71545820ed6258683d03a9aa3a97db586aea7d148090b4fa4

NanoCore

99c574b7d4be75a2323c02a53b378b067359be1adf925e5a17414226bd42ddbe

NanoCore

a37f501c2d65d191828fe20bf148436de23201f6fe852d59dfa67aaa5fc206e8

NanoCore

a6326d16b92f9d360ddce0cab666de27a10863a36f11e9acaf663342def74fff

NanoCore

d0a9cde7ebed2daf4306e0e76a341e6c4293bf9904ed464f5bfcb462dc0999d0

NanoCore

df0c82790a3c6e0f1280a03ba2bc07e239a8119f8ae9d78108ec0bdfa93d8c36

NanoCore

+ 1'217 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201109-7xlbphrq72/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Drops startup file

NanoCore

Malware Config

C2 Extraction:

chaya.ddns.net:1960
185.140.53.208:1960

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/