MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 819b7cdae5437e09dddc2263080df829d2e8ba725f4364bfddf0cd10eb848692. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 819b7cdae5437e09dddc2263080df829d2e8ba725f4364bfddf0cd10eb848692
SHA3-384 hash: 480f532518bf83ed49dc0cf248ed881f461f2ecece99ec77b99d438f5cc4b2e1d866ef13b870aa0277596a4731c1c234
SHA1 hash: dce1214e8454850690769f0794f86a56703cc1b7
MD5 hash: 13824c964dd1acd3ec4c57ce743b5886
humanhash: july-mountain-double-minnesota
File name:UPS Attachment.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:524'288 bytes
First seen:2020-04-12 08:13:28 UTC
Last seen:2020-04-12 08:38:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 6144:KjpSfiATrVrhovo3vr0YIwpvhPBRxqF57sTHonoHJVpQ8WXUlrMSnoiI+hwLzB:gsVXVrhSoj0YHps57CJV7JMSnoivh2d
Threatray 1'183 similar samples on MalwareBazaar
TLSH F3B49D0867F54A6AE7FD07B864F554004FB8F506E063E70F5BB4A0F81E637A09E9931A
Reporter jarumlus
Tags:NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.9769.17838.15496.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Nanobot
Create hunting rule
Status:
Malicious
First seen:
2020-04-12 01:27:13 UTC
File Type:
PE (.Net Exe)
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qgnxzwxfin7atxo4ejrqqdpyfhjorotsl5bwjp656dgrb24eq2ja._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
08c1ed3585826baa8e470be4c446478a895317380573ef787e53afdc264569e3
NanoCore
3964739a8988be3dc3ffe71ce4fdd86bfef579f4cfdfac1c97d123805cd0ea2a
NanoCore
7517598e76a259f655059544b46dfe2a509fb56fbdc7cee743dfbdaff5c722da
NanoCore
7528449cf7a3a8d1b8d56a5207cbcff5c2afe95aa6f4258acfa858a28bd370f5
NanoCore
a6b6bafbfe0f877c68f0429898e7dbc9c5307d5d2b58cce6522f9c251958ed05
NanoCore
b78996718e94fe9cf9cc228f474b774fd7bd54133762d183ba2e6c141b3a218a
NanoCore
c068b1a7379f95ee883cd4ed9639bb2b28c380934f3bc0e0c7be97ad808c7b8a
NanoCore
d1890599ae15f13b1fc26efd5221a7a20949db644edc28aa3480c0042dc0a6fc
NanoCore
dc28fee9ff485f98bb7a9369a6e24ad8f1a63c123cc9c39ee676d933e1999fc6
NanoCore
dca09e669f01dcc5efa9ab9120ce3febd53868b3ba12a6e0b4574b82b3d0e392
NanoCore
+ 1'173 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments