MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9352a90a15c864ae05d1d1138aff00094883dc44afffc471e837e46fe3eb24e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9352a90a15c864ae05d1d1138aff00094883dc44afffc471e837e46fe3eb24e
SHA3-384 hash: 49a56ea54e992f3041dab1fb80477a92fbada07886c989b11bfc683b019b6d83d16e50835665e805fb18d868b2363adb
SHA1 hash: 802f68b12a3c4b574a7f75f24d43e41e06e105c0
MD5 hash: c2ae801ef06c2ccb81a80b570d37083d
humanhash: blossom-summer-venus-network
File name:halkbank,pdf.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:517'632 bytes
First seen:2020-06-16 13:55:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:xq3SO4fIE3Bgc3YxPZA1ft6U1Im1LS0UI/flwO9lCpgfzy30kc:xcEicoxPZE6Al
Threatray 5'401 similar samples on MalwareBazaar
TLSH 8AB48F783610739FD726B5E189943C20F6AC67EAE237CDC3A8831198694D8C69F513ED
Reporter abuse_ch
Tags:exe geo Halkbank NanoCore RAT TUR


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: halkbank.com.tr
Sending IP: 156.96.62.208
From: HALKBANK.E-EKSTRE@halkbank.com.tr
Reply-To: HALKBANK.E-EKSTRE@halkbank.com.tr <samlog427@gmail.com>
Subject: T.HALK BANKASI A.S. 16.06.2020 Hesap Ekstresi
Attachment: halkbank,pdf.z (contains "halkbank,pdf.exe")

NanoCore RAT C2:
jfncghc.ddns.net:4040 (156.96.62.208)

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11037/
Gathering data
Threat name:
ByteCode-MSIL.Trojan.RandomKrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 13:57:04 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ve2svefblsdevyc5duitrl7qackiqpoejl77yry6qn7en7r6wjha._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
24683ff5c436b2b56e96268ba4c591e8f80e9995623a0a1f6e6c7adf5bd2a62c
NanoCore
4d13350ebf3d38475a0a4a8c223fe6c06e00af3585eb499f60e29639b3944d3f
NanoCore
6eb10ca3e8026756f417b8e04510f768c28175817c73be8f21514dfb186d687f
NanoCore
83b70b20d0cdb13e9c420723ba5f025827d21e0c051c6e64b5553a5c372c3374
NanoCore
b0450bd92e2100b37b46cbea0e8051b1865a7f69faf6b30671f1b4a045b85325
NanoCore
bbcd00ab6d762a74c3c2e6da18d74880c6277de30205f0ad758b4968103415f7
NanoCore
be240aed297970b0e97f46ce8964784645c8bfeb7b4ffc451ab7857b7df8438f
NanoCore
c0fe48e42fb4769fd14e90de135d33729de312e0b82ba907885b26462f80af01
NanoCore
c906c5770bebca31da7c8da7a639ec54531022d2a88bc133f89f793e7a3d737d
NanoCore
e7fa1cf008969a70a894b2947737b69c26abb63378d9d4305b698b223793029f
NanoCore
+ 5'391 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore persistence
Link:
https://tria.ge/reports/200624-vb32l2byr6/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
jfncghc.ddns.net:4040
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 989f797cd2fdf4a061dffaab1f1e15194221a3fe0a1d9e1372d32dcd331b9f27

NanoCore

Executable exe a9352a90a15c864ae05d1d1138aff00094883dc44afffc471e837e46fe3eb24e

(this sample)

  
Dropped by
MD5 49e1854598850d51da096aa44d4f586b
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 989f797cd2fdf4a061dffaab1f1e15194221a3fe0a1d9e1372d32dcd331b9f27
Cape
Cape
https://www.capesandbox.com/analysis/11037/

Comments