MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88934e67e9916e0dfbe942ad282705bd312059d8c1126ce72cf3cff08bfc533a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88934e67e9916e0dfbe942ad282705bd312059d8c1126ce72cf3cff08bfc533a
SHA3-384 hash: d16c3cde54bd1dc25c56d97b90c998f2245cc561b26dcc4235c048b8a91c2a56321779337253b8a4236e44d42fe73918
SHA1 hash: 03bf4ad372df7b87035073df134c192d5f734bde
MD5 hash: 1100e0ea97beb0ed701fe4978292b907
humanhash: cold-florida-six-zebra
File name:1100e0ea97beb0ed701fe4978292b907.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:610'304 bytes
First seen:2022-07-28 01:50:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be63889866f6bba2109402ee273e5652 (3 x RemcosRAT, 2 x RedLineStealer, 1 x QuasarRAT)
ssdeep 12288:fYEKnVgX87SdLV6BtpmkGFmC83KWH2cEWckVzYZkhNFl+MFnWFHzJ+:HZX8m1ApfGFmDWcIkV4TJ+
TLSH T12DD4BF3A67818816C2EE01F8F1A6426501799A335356F3CF6BD508FA1F522CDFA2B1D7
TrID 37.4% (.EXE) Win32 Executable Microsoft Visual Basic 6 (82067/2/8)
33.3% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
14.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
4.8% (.EXE) Win64 Executable (generic) (10523/12/4)
3.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 1003873d31213f10 (142 x DarkCloud, 132 x GuLoader, 35 x a310Logger)
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore C2:
185.157.162.187:60140

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.157.162.187:60140/Vre https://threatfox.abuse.ch/ioc/838873/

Intelligence

File Origin
# of uploads :
1
# of downloads :
332
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/294784/
Detection(s):
Win.Trojan.NanoCore-9852758-0
Create hunting rule

Win.Malware.Razy-7697300-0
Create hunting rule

Win.Packed.Generic-9777790-0
Create hunting rule

Win.Trojan.Generic-9783914-0
Create hunting rule

Win.Dropper.Nancrat-9869495-0
Create hunting rule

Win.Dropper.Nanocore-9916514-0
Create hunting rule

Win.Malware.Formbook-9951648-0
Create hunting rule

Win.Malware.Formbook-9951997-0
Create hunting rule

Win.Trojan.Nanocore-5
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Searching for synchronization primitives
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Launching a process
Launching cmd.exe command interpreter
Reading critical registry keys
Moving a file to the %temp% directory
DNS request
Sending an HTTP GET request
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook greyware nanocore packed rat shell32.dll
Link:
https://www.filescan.io/uploads/62e1eb88e18d450dc68da2f9/reports/ff99df11-f80b-4502-a80e-d38d8c8bba7b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f6ee4b0-30b5-47d4-8a08-e037cb2a2720
Result
Threat name:
Nanocore, AgentTesla, FormBook
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1042199
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential malicious icon found
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: NanoCore
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected FormBook
Yara detected Generic Downloader
Yara detected Nanocore RAT
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 674693 Sample: 34H7G1rWpu.exe Startdate: 28/07/2022 Architecture: WINDOWS Score: 100 52 www.marijevanrijn.site 2->52 54 www.ingeniousconsultingservices.com 2->54 56 4 other IPs or domains 2->56 64 Snort IDS alert for network traffic 2->64 66 Potential malicious icon found 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 19 other signatures 2->70 11 34H7G1rWpu.exe 4 2->11         started        signatures3 process4 file5 42 C:\Users\user\AppData\...\ori40teleevery.exe, PE32 11->42 dropped 44 C:\Users\user\AppData\...\naono60140ned.exe, PE32 11->44 dropped 46 C:\Users\user\AppData\Local\Temp\bin.exe, PE32 11->46 dropped 14 bin.exe 11->14         started        17 ori40teleevery.exe 15 2 11->17         started        21 naono60140ned.exe 1 13 11->21         started        process6 dnsIp7 80 Antivirus detection for dropped file 14->80 82 Multi AV Scanner detection for dropped file 14->82 84 Machine Learning detection for dropped file 14->84 94 5 other signatures 14->94 23 explorer.exe 3 14->23 injected 48 api.telegram.org 149.154.167.220, 443, 49744 TELEGRAMRU United Kingdom 17->48 36 C:\Users\user\AppData\...\tmpG91.tmp (copy), PE32 17->36 dropped 86 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->86 88 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->88 90 Tries to steal Mail credentials (via file / registry access) 17->90 96 4 other signatures 17->96 50 185.157.162.187, 49740, 49741, 49742 OBE-EUROPEObenetworkEuropeSE Sweden 21->50 38 C:\Program Files (x86)\...\dhcpmon.exe, PE32 21->38 dropped 40 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 21->40 dropped 92 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->92 file8 signatures9 process10 dnsIp11 58 www.la-bites.com 151.101.66.199, 49782, 80 FASTLYUS United States 23->58 60 colwoodrealtyauction.com 209.15.37.6, 49785, 80 COGECO-PEER1CA Canada 23->60 62 3 other IPs or domains 23->62 72 System process connects to network (likely due to code injection or exploit) 23->72 27 mstsc.exe 23->27         started        30 dhcpmon.exe 3 23->30         started        signatures12 process13 signatures14 74 Modifies the context of a thread in another process (thread injection) 27->74 76 Maps a DLL or memory area into another process 27->76 78 Tries to detect virtualization through RDTSC time measurements 27->78 32 cmd.exe 1 27->32         started        process15 process16 34 conhost.exe 32->34         started       
Detection:
xloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/88934e67e9916e0dfbe942ad282705bd312059d8c1126ce72cf3cff08bfc533a/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2022-07-25 17:00:00 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rcju4z7jsfxa367jikwsqjyfxuysawoyyejgzzzm6ph7bc74km5a._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:formbook family:nanocore family:xloader campaign:mdzq collection evasion keylogger loader persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/220728-b9tcwabegl/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: SetClipboardViewer
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks whether UAC is enabled
Checks computer location settings
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
Xloader payload
AgentTesla
Formbook
NanoCore
Xloader
Malware Config
C2 Extraction:
https://api.telegram.org/bot5171883538:AAEyFWuNh68SJNNpkDCQbviRgrklZA3K4Qs/sendDocument
185.157.162.187:60140
127.0.0.1:60140
Unpacked files
SH256 hash:
358b07b04de6d4a56f638eb7af0d932e62d47fe7f1a2b2f163aec29d62c97299
MD5 hash:
42e237ada512f52e4740ff946c18276a
SHA1 hash:
54b6bbd22906c9d7fd57d81063880fcc4362f113
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
XLoader
Create hunting rule
Link:
https://www.unpac.me/results/233f3540-ce4d-4bb0-a0ec-1a40922b4a3f/
SH256 hash:
88934e67e9916e0dfbe942ad282705bd312059d8c1126ce72cf3cff08bfc533a
MD5 hash:
1100e0ea97beb0ed701fe4978292b907
SHA1 hash:
03bf4ad372df7b87035073df134c192d5f734bde
Detections:
win_formbook_g0
Create hunting rule
win_nanocore_w0
Create hunting rule
XLoader
Create hunting rule
Link:
https://www.unpac.me/results/233f3540-ce4d-4bb0-a0ec-1a40922b4a3f/
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/88934e67e991/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:malware_Formbook_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:malware_Nanocore_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_NanoCore
Create hunting rule
Author:ditekSHen
Description:Detects NanoCore
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Feb18_1_RID2DF1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:Nanocore_RAT_Gen_2_RID2D96
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_nanocore_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/294784/

Comments