MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 5 Comments

SHA256 hash: b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d
SHA3-384 hash: c19dde3442542c34f996244dc144acc5d12c436ea5b42d61437a80b5c761e300502c42d08d44ace655d39fc35983d8ae
SHA1 hash: e28e2c1941d19c85726f5110e0078b6dcae783a0
MD5 hash: 27ff2f504a80e168edda11336c3f306a
humanhash: michigan-dakota-whiskey-happy
File name:b1a284146f9726d4cc73aa5bf464ee1fced92c6cef94da053d5ab5c3bc1c658d
Download: download sample
Signature NanoCore
File size:1'323'008 bytes
First seen:2020-06-16 09:29:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7
ssdeep 24576:bAHnh+eWsN3skA4RV1Hom2KXMmHaZnehMbac+2J5ZICWVJyCTg3gJaGCTk5:2h+ZkldoPK8YaZnehQH9J5OBJyCMQJjB
TLSH E855CE0273E1C036FFABA2739B6AF60556BC78254123852F13981DB9BD701B1276E763
Reporter @JAMESWT_MHT
Tags:NanoCore

Intelligence


File Origin
# of uploads :
1
# of downloads :
19
Origin country :
IT IT
Mail intelligence
No data
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Status:
Malicious
First seen:
2020-06-15 16:21:22 UTC
AV detection:
26 of 31 (83.87%)
Threat level
  5/5
Result
Malware family:
nanocore
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:nanocore persistence evasion
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Checks whether UAC is enabled
Drops startup file
NanoCore
Malware Config
Extraction:
79.134.225.22:7290

Yara Signatures


Rule name:ach_NanoCore
Author:abuse.ch
Rule name:Nanocore
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Author: Kevin Breen <kevin@techanarchy.net>

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments