MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3fd83d19a65a806d17f9c5245b94d7499e711f56814a2d1fe4ae62474315781. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3fd83d19a65a806d17f9c5245b94d7499e711f56814a2d1fe4ae62474315781
SHA3-384 hash: 3f78b115e3c3432055902daef2fea68f9a0196364d2fbb388e2876f9b34531ab888f389197397c30583e7dc62b64db99
SHA1 hash: 3de1fbe8198880e2005b7e7d26e288d068165acd
MD5 hash: a8cd86a7698875d1eba6a5b03d24e61b
humanhash: fourteen-orange-muppet-uncle
File name:TBA.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:504'320 bytes
First seen:2020-07-21 06:33:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:nhh9zi5iISyRw6TBSXnjYvfLaWtHVkMh82fYYNJZVwHxYojh7DtItOfaH:hsEXjwRtaW82fxNTqxYojh/tItuaH
Threatray 1'194 similar samples on MalwareBazaar
TLSH 13B47C44D7F84ACAE3BA57BDE470000087B5B50AA7EAE7595B91F0ED1822761CB13F27
Reporter abuse_ch
Tags:exe NanoCore nVpn RAT THA


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.fco.pt
Sending IP: 151.236.39.153
From: TBA <infos@thailandbuyingagency.com>
Subject: ระบุรายการราคา สำหรับ TBA (thailandbuyingagency.com)
Attachment: TBA.arj (contains "TBA.exe")

NanoCore RAT C2:
isiefi.ddns.net:9909 (185.140.53.13)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE-NL4
country: EU
descr: Zaventem, Belgium
descr: Amsterdam, Netherlands
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-16T21:16:41Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/29708/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/392514
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 248447 Sample: TBA.exe Startdate: 21/07/2020 Architecture: WINDOWS Score: 100 36 isiefi.ddns.net 2->36 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for dropped file 2->44 46 8 other signatures 2->46 8 TBA.exe 9 2->8         started        11 wpasv.exe 4 2->11         started        signatures3 process4 file5 26 C:\Users\user\AppData\Roaming\sBjJNTRC.exe, PE32 8->26 dropped 28 C:\Users\user\AppData\Local\...\tmp6EF2.tmp, XML 8->28 dropped 30 C:\Users\user\AppData\Local\...\TBA.exe.log, ASCII 8->30 dropped 13 MSBuild.exe 1 8 8->13         started        18 schtasks.exe 1 8->18         started        20 MSBuild.exe 8->20         started        22 conhost.exe 11->22         started        process6 dnsIp7 38 isiefi.ddns.net 185.140.53.13, 49741, 49742, 49743 DAVID_CRAIGGG Sweden 13->38 32 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 13->32 dropped 34 C:\Program Files (x86)\...\wpasv.exe, PE32 13->34 dropped 48 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->48 24 conhost.exe 18->24         started        file8 50 Uses dynamic DNS services 38->50 signatures9 process10
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b3fd83d19a65a806d17f9c5245b94d7499e711f56814a2d1fe4ae62474315781/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:35:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wp6yhum2mwuanul7trjeloknosm6oepvnakkfup6jltci5brk6aq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
1583c29f396b51c03866ecbac92dfae57d41c361d8f6f5ae71600a84a4b9033d
NanoCore
430a7e324ab686d71a38548850bb90d018b0d7aec9cdbccb7289beb4d09f5a9f
NanoCore
5df080a145c2dd20f01dcb463efbc7fc1fc1c5bb61567b972c8b4ceb62338088
NanoCore
92d2689159c5984751e67f61486e25a8f66921d372249af5ac22078cf22c8be9
NanoCore
946cdeba80da84a83af805ec82e7f07819ed853356d1d546be0c5ac28b5f70d4
NanoCore
9de706b1203364aae5f475621ec5855b8163adc972693b40446fb6ba82b19209
NanoCore
a78239b17de3eac55e5fcbeceefdd2fe78f76888a2639f54024232b4dcda394c
NanoCore
ccf661061226a4fe358b46c6fab8a29686323e41aa50fe06c06963c9939a2669
NanoCore
da7ce8060ef04b847aeb11d727b9d8fad9526dc3314adce4ffa5e0b597ac5547
NanoCore
f0bdd59b67a442209f68d9adf125fbadd7e99324ca917822d5f5f29e976b5b26
NanoCore
+ 1'184 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore persistence
Link:
https://tria.ge/reports/200721-h2qwc2atda/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Creates scheduled task(s)
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
isiefi.ddns.net:9909
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3fd83d19a65a806d17f9c5245b94d7499e711f56814a2d1fe4ae62474315781

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 81630e871a0be893df07958d294ceda64577f410d372e56040a507ed089cc79a

NanoCore

Executable exe b3fd83d19a65a806d17f9c5245b94d7499e711f56814a2d1fe4ae62474315781

(this sample)

  
Dropped by
MD5 df67239374a217a24c16b9f4cdda16ae
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 81630e871a0be893df07958d294ceda64577f410d372e56040a507ed089cc79a
Cape
Cape
https://www.capesandbox.com/analysis/29708/

Comments