MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b07ef4c584528991957dfbc17e62984fe06a6ae8ab441062b3d6910bbedf36b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b07ef4c584528991957dfbc17e62984fe06a6ae8ab441062b3d6910bbedf36b5
SHA3-384 hash: b12d80b49949a46a5ea094e2ce15bb5350f4bf2e5af21972eac739a78f6bb67d984940f82a88f7eb267a9a9163893c0c
SHA1 hash: 2e9cd07ecc1d8ddc82424319bff2f7fcda7b99f2
MD5 hash: 9540368422b547e73704b4b4ea23b3e2
humanhash: delaware-bluebird-muppet-butter
File name:Hakuto Singapore Pte. Ltd - products lists.xls.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'352'704 bytes
First seen:2021-06-22 11:28:00 UTC
Last seen:2021-06-22 12:36:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:EJZaF9GF2WXXIcXoCXXIcXo0XXIcXo/++NmvbNQqmTMW1E7YWrHAivZi5Qggd3+9:fjOvRCrebNQfHE7YWrHPE5M+apppo
Threatray 8'047 similar samples on MalwareBazaar
TLSH B2558E0CA49E9953D67AFB748AF1F950D33CAFA47C3BD02F05B2389BEA39D891452441
Reporter malwarelabnet
Tags:AsyncRAT exe NanoCore

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.222.57.233:2059 https://threatfox.abuse.ch/ioc/139869/

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Hakuto Singapore Pte. Ltd - products lists.xls.exe
Verdict:
Malicious activity
Analysis date:
2021-06-22 11:30:34 UTC
Tags:
trojan rat asyncrat
Link:
https://app.any.run/tasks/1504524d-fa25-4e2a-a7a8-a30ce09d5114

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167540/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.867.25952.3802.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a1f69e46-d27c-42a9-8d11-92b552c3df36
Result
Threat name:
Nanocore AgentTesla AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/805910
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: NanoCore
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected Costura Assembly Loader
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 438321 Sample: Hakuto Singapore Pte. Ltd -... Startdate: 22/06/2021 Architecture: WINDOWS Score: 100 60 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->60 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 19 other signatures 2->66 9 Hakuto Singapore Pte. Ltd - products lists.xls.exe 7 2->9         started        process3 file4 44 C:\Users\user\AppData\...\ydPshuIymPxJWw.exe, PE32 9->44 dropped 46 C:\...\ydPshuIymPxJWw.exe:Zone.Identifier, ASCII 9->46 dropped 48 C:\Users\user\AppData\Local\Temp\tmp54B.tmp, XML 9->48 dropped 50 Hakuto Singapore P...s lists.xls.exe.log, ASCII 9->50 dropped 84 Injects a PE file into a foreign processes 9->84 13 Hakuto Singapore Pte. Ltd - products lists.xls.exe 2 5 9->13         started        18 schtasks.exe 1 9->18         started        signatures5 process6 dnsIp7 58 185.222.57.233, 20209, 2059, 49728 ROOTLAYERNETNL Netherlands 13->58 52 C:\Users\user\AppData\Local\Temp\wlgqtb.exe, PE32 13->52 dropped 54 C:\Users\user\AppData\Local\Temp\iwwyii.exe, PE32 13->54 dropped 86 Tries to harvest and steal browser information (history, passwords, etc) 13->86 20 cmd.exe 1 13->20         started        23 cmd.exe 1 13->23         started        25 conhost.exe 18->25         started        file8 signatures9 process10 signatures11 68 Suspicious powershell command line found 20->68 70 Bypasses PowerShell execution policy 20->70 27 powershell.exe 15 20->27         started        30 conhost.exe 20->30         started        32 powershell.exe 11 23->32         started        34 conhost.exe 23->34         started        process12 dnsIp13 56 192.168.2.1 unknown unknown 27->56 36 wlgqtb.exe 2 27->36         started        39 iwwyii.exe 32->39         started        process14 file15 72 Antivirus detection for dropped file 36->72 74 Multi AV Scanner detection for dropped file 36->74 76 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 36->76 78 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 36->78 42 C:\Users\user\AppData\Roaming\...\run.dat, data 39->42 dropped 80 Machine Learning detection for dropped file 39->80 82 Hides that the sample has been downloaded from the Internet (zone.identifier) 39->82 signatures16
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b07ef4c584528991957dfbc17e62984fe06a6ae8ab441062b3d6910bbedf36b5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 11:16:43 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wb7pjrmekkezdfl57pax4yuyj7qgu2xivncbayvt22iqxpw7g22q._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
nanocorerat
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
0cbbdd2c9615f4d2de4e0232ace6b69889a54538444838ac6616a5aa39109c98
NanoCore
1e6cf0bf090cbdb064a483cacc7bb094759083e8b5f199be562e30fed979398f
NanoCore
623d707cab5c5dc378a5100018e29f88949f4ea4be4b34cc2fc36e1612b68100
NanoCore
68bf0a42854ac13fe13a75bb213f51934a3edc0fa7a0732ddb12a68699619474
NanoCore
7a388ead62a8f818b36c9c9a1938c2172c4fa05edfc71307980131c53c69d054
NanoCore
7da044c42ca2197b24b974350ae45f50ba9573714685c175026ff4a29a57973b
NanoCore
83a5d6da50195774a35e46a89d8d9854b4282ec5a3fffa02fa0f7c90d274117f
NanoCore
90c16db8c607f8ea1d0ed85c003b30692128327b4593e2fb45121a564fac6c11
NanoCore
cac57f9210fa4d8fb970249750db6886d99f31e503cdeb6e4641bf1c0055afe7
NanoCore
ddaaa650d42caaed5ddd7c307b986cdccfc25bcb84c7a4f29f9fddd26add4135
NanoCore
+ 8'037 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:asyncrat family:nanocore evasion keylogger rat spyware stealer trojan
Link:
https://tria.ge/reports/210622-vee4878lpa/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla Payload
Async RAT payload
AgentTesla
AsyncRat
NanoCore
Malware Config
C2 Extraction:
185.222.57.233:2059
185.222.57.233:20209
127.0.0.1:20209
Unpacked files
SH256 hash:
7f1fe2c8305adc99e4eb3b89d96a31a064930d23164d828d27a4f60c5fc17768
MD5 hash:
785396f14788772d5ba1547660573f73
SHA1 hash:
a747a5e06d6e20ea06eaa155e9dc31073eba302e
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/179c860b-ee67-49f6-8a01-d1bd511fe00a/
SH256 hash:
06306e33b7e10429759ab8c42e31e9eb8edbd76c4f1a792a5c231a57876ea338
MD5 hash:
5bdd03077864d32db51b085294859f68
SHA1 hash:
70392a93a4c8be2377915fd6e6d3e7a3a9600adf
Link:
https://www.unpac.me/results/179c860b-ee67-49f6-8a01-d1bd511fe00a/
SH256 hash:
900240cc735604f453c5500487967e2a7a8bad7df97dc70fd6956bf2d27a2a7f
MD5 hash:
d164c2d6a5398c04d8a8a368196b2f75
SHA1 hash:
4a1a5c94946b699513d3298fb77336ff48e8ec76
Link:
https://www.unpac.me/results/179c860b-ee67-49f6-8a01-d1bd511fe00a/
SH256 hash:
b07ef4c584528991957dfbc17e62984fe06a6ae8ab441062b3d6910bbedf36b5
MD5 hash:
9540368422b547e73704b4b4ea23b3e2
SHA1 hash:
2e9cd07ecc1d8ddc82424319bff2f7fcda7b99f2
Link:
https://www.unpac.me/results/179c860b-ee67-49f6-8a01-d1bd511fe00a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b07ef4c584528991957dfbc17e62984fe06a6ae8ab441062b3d6910bbedf36b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:pe_imphash
Create hunting rule
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167540/

Comments