MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80f7cf5c13b590c2c2827174cb3d856e19afd61a439af498d5f812c909382abe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80f7cf5c13b590c2c2827174cb3d856e19afd61a439af498d5f812c909382abe
SHA3-384 hash: 6aa45d251696e4a1336cf2c4b2a81ee3ba71cc108fabb66cf2187b530e4ae57852fbfb5aee3ef41265994099f94d8067
SHA1 hash: fbe1384292e70c016b56d113e77cc6f1e7eed77c
MD5 hash: 7db1b44f6ea4adad2beaad9b5417d399
humanhash: bacon-hamper-south-georgia
File name:Notificare de expediere a serviciului de curierat FAN.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:629'248 bytes
First seen:2020-09-16 12:41:22 UTC
Last seen:2020-09-16 13:40:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:782jVv2zv1gVx+YW1SdB1mMRc4a2TRKEHIE:782o2z+TIX1LK4aW7I
Threatray 1'074 similar samples on MalwareBazaar
TLSH FED4AE227348D655C47D1B3C2C6CD3C41BB6BD80AE09E6ED3898337E6932B969712673
Reporter James_inthe_box
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/62072/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.432.13586.27578.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/467850
Signature
.NET source code contains potential unpacker
Detected Nanocore Rat
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/80f7cf5c13b590c2c2827174cb3d856e19afd61a439af498d5f812c909382abe/
Threat name:
ByteCode-MSIL.Dropper.OverJoiner
Create hunting rule
Status:
Malicious
First seen:
2020-09-16 12:41:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
24 of 29 (82.76%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qd346xatwwimfqucof2mwpmfnym27vq2ionpjggv7ajmscjyfk7a._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
17fa709f1a866d573f997f8f1288d537de382cccc5a4f9c1811db9da34c016b2
NanoCore
2273296f635f3e62fab2910123b1cf32832e3b62344a346a8663c2a31f00a98d
NanoCore
4c98f097a7d17f8919c172ba7fe52b8600d8edd484ded4637dade9cbb9201c18
NanoCore
4d6a4c556af5a4e4a05ca5aadb976af1f792bb509cd17cf26aa2ca3081317e3c
NanoCore
5c25185beb2246bba9f097cb915dcc1560c80527c6750d6da5737c29de2db217
NanoCore
682cb1c003d98478150a40e5a6eed75332e34a611749eed232e88bf6020b2c4b
NanoCore
7ef854b108810696668476ae3e43cae11698d70d462d7364a58f292df583f41d
NanoCore
9af6516cda835f72d8c23f643d16035d6ed101bfcad887689d3c37a1cdfac91b
NanoCore
a1164f44afc2ceee90a833e950f23a3bb69c4557331cadb35e4f95bf335f1b27
NanoCore
ab1ee0b548744b3e7892af6517a41f37b462856e0b744bd9ad58af079771db33
NanoCore
+ 1'064 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200916-72wl2snmm6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
194.5.98.4:2010
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/80f7cf5c13b590c2c2827174cb3d856e19afd61a439af498d5f812c909382abe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/62072/

Comments