MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 814eaf5f7ac92cfed0226402ff7075efe5c0d81e7b555d01376db3e62e34595c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	814eaf5f7ac92cfed0226402ff7075efe5c0d81e7b555d01376db3e62e34595c
SHA3-384 hash:	89170fed00c113a39e269d90e23c25d454233c82999f60095601d0bdbdfdcc870b1aae78c91b7a8134f51373ee3b9470
SHA1 hash:	71692814d2b90c07c814690651132abba928cb78
MD5 hash:	b2082798207f3f541b6ba40036828572
humanhash:	hot-maine-monkey-bacon
File name:	9lNF8xaBBUKKfKA.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	418'304 bytes
First seen:	2020-07-22 07:05:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:pNHr2tJWPUm2iNSUAEMitn7Sa2pvCPpAsmrW:pUWcm1iExOh
Threatray	1'659 similar samples on MalwareBazaar
TLSH	A994CE10EBF807D9EB6947B9D16154509BB5A62E63EAE30D1F82F0EC0932B405723F67
Reporter	abuse_ch
Tags:	CHN exe geo NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: vps.orthilis.com
Sending IP: 45.95.169.120
From: Eva Huang <info@orthilis.com>
Subject: Re: 请求订单
Attachment: 请求订单.r11 (contains "9lNF8xaBBUKKfKA.exe")

NanoCore RAT C2:
myduck222.duckdns.org:6532 (185.140.53.11)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE-NL4
country: EU
descr: Zaventem, Belgium
descr: Amsterdam, Netherlands
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-16T21:16:41Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/30829/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.26671.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a process with a hidden window

Result

Threat name:

Nanocore

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/394515

Behaviour

Behavior Graph:

Download SVG

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/814eaf5f7ac92cfed0226402ff7075efe5c0d81e7b555d01376db3e62e34595c/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-22 07:07:06 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qfhk6x32zewp5ubcmqbp64dv57s4bwa6pnkv2ajxnwz6mlrulfoa._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

2ed8cd44621cc06fa9a00f11b5217fe58839a8ec6bfee8d42f78f61263652da5

NanoCore

476d02f7c777bb08d97cf87c305e3cb4f41501c1b15ddd88e55f31bff0767b0a

NanoCore

49aaf4ae6bf7f60a07c4ffc43ca0be27fce694446436dd07aac5db362142c2c8

NanoCore

75fc0beb16fbe8af2f46d2cfcb7176af4289430516d74017d1a32cd0c37859c0

NanoCore

9256cc7129421443ba770b55f01042e58fa5af856df1db31e830f147213c2a1c

NanoCore

afd354c93f9c9ad2324dd4ecd1e58041f373f1b3360ef8ce2792e437bd104a8d

NanoCore

d5dd3977cdc2602a68093c08e166b1508253ef0934f986d00be980e47b7c50f9

NanoCore

dec608206e941da5042333c8e35fe01bb17e50cc67ec58b03e872694cb5e219b

NanoCore

f8a0ada1c983c16a3ff6b107c2a04cac970e51ba9bec2514771271af03b7b9fc

NanoCore

+ 1'649 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/200722-nfwlnyryrj/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Program crash

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/814eaf5f7ac92cfed0226402ff7075efe5c0d81e7b555d01376db3e62e34595c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/