MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b06c86dae636716a828d1dcc1e56ff8d6152fedba019b8da0ba0faa45aaebbd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	b06c86dae636716a828d1dcc1e56ff8d6152fedba019b8da0ba0faa45aaebbd6
SHA3-384 hash:	1e699155a1d10fa7de91bd519ae27bbcd9d81a7b7892e2a66c344cf8c4359ab1a877f24d42827aa068a5adfcdfa8f1bf
SHA1 hash:	9e0697c62b21d81f16ddf99344709203977df5c3
MD5 hash:	de744ea6c48b398f88b6ac61785d8a5d
humanhash:	football-two-sodium-juliet
File name:	POEA ADVISORY NO. 60- 2020 SERIES-AGENCY RE-VALIDATION.PDF.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	1'164'429 bytes
First seen:	2020-05-21 09:23:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep	24576:6NA3R5drXstiazTTXDmZJ6ypras3cbOYdxxO77aNlfUQ6BEB:z5Mi67mZkQrv3cbRxxO7WNl8Q6BC
Threatray	1'272 similar samples on MalwareBazaar
TLSH	08451202BBC185B2D6732A360E357761A97CBA341F64CB1E63D44D6ECE71491A231BB3
Reporter	abuse_ch
Tags:	exe NanoCore RAT

abuse_ch

Malspam distributing NanoCore:

HELO: gmmgroupasia.wsiph2.com
Sending IP: 173.230.147.68
From: POEA <info1@poea.gov.ph>
Subject: POEA ADVISORY NO. 60- 2020 SERIES/AGENCY RE-VALIDATION.
Attachment: POEA ADVISORY NO. 60- 2020 SERIES-AGENCY RE-VALIDATION.UUE (contains "POEA ADVISORY NO. 60- 2020 SERIES-AGENCY RE-VALIDATION.PDF.exe")

NanoCore RAT C2:
leewardmarineservices.mywire.org:54985 (185.140.53.136)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Malware.Autoit-7600991-0

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Occamy

Status:

Malicious

First seen:

2020-05-21 09:45:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 31 (70.97%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wbwinwxggzywvaundxgb4vx7rvqvf7w3uam3rwqlud5kiwvoxpla._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

1c9ac73de149a9df1d58572db60bfa8824470f11c109ea55b91aada0d6c8a2a6

NanoCore

5653b1af20456384193f0f45cb4b6d20713a834e69d9491da3f8016779b10fc4

NanoCore

69aefba0bddbb8f38a5913d51d61936647e4dfccd4d561f51519f5a35d7f834c

NanoCore

71f75231ec231d35684b7b43f0b599fb8eae9978ae979c9ebb9f484ce405e7f1

NanoCore

772d2f2ea97be3c0b9948701fb6743fc8f717680420fe5ce0101eac3ac6cd1c7

NanoCore

8d5d64d7fe461ea3d2c4ef989b5919dd74f0d7a5803fcaeb23bda4d815f22d83

NanoCore

b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c

NanoCore

cbc2cd6401ee2dffa529cfac703476c24833eda31b951c8ab178b878f0247b38

NanoCore

f6a3616478400ad9ef7ddde32888050dd08b0fbdcf6ad8372aa3bd414e5b4416

NanoCore

+ 1'262 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore evasion keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/201109-mccym9v1me/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Adds Run key to start application

Checks whether UAC is enabled

Loads dropped DLL

Executes dropped EXE

NanoCore

Malware Config

C2 Extraction:

leewardmarineservices.mywire.org:54985
leewardmarineservices.duckdns.org:54985

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/