MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b61341f38e33a3eeee6ef999b73067de9cd2d0cbfd97bdb426fdd0b06e5e07eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b61341f38e33a3eeee6ef999b73067de9cd2d0cbfd97bdb426fdd0b06e5e07eb
SHA3-384 hash: 16fbfa12526d9c0623ecb13d086bf9492e6aad151641b5e12cb160b2f952528c575b656f2ad074b12d04c4d1429009f1
SHA1 hash: 475e82eef1deded52b171df2f5aa6a1333739ba5
MD5 hash: 53383d5a423c80ab9a4c4d9d29f20cfb
humanhash: uniform-thirteen-early-island
File name:new quote.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:290'816 bytes
First seen:2020-05-12 08:55:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:iZf8laPUvQg2n+fVk0xsnxPc0xtDckNP/EvXCs1:O8YPQp2+fi0xsn+0HDDnUCs1
Threatray 1'107 similar samples on MalwareBazaar
TLSH DE54582D687D323FD9A8D6B6CFB598E7FD9084AB35231A2980DF5E414651E213EC312C
Reporter abuse_ch
Tags:exe NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: www2929.sakura.ne.jp
Sending IP: 49.212.198.169
From: sales@tokusyuneji.com <support@tokusyuneji.com>
Reply-To: support@tokusyuneji.con
Subject: urgent quotation for order
Attachment: new order.doc.z.rar (contains "new quote.exe")

NanoCore RAT C2:
91.193.75.137:1604

Hosted on nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
descr: We ask all employees of Spamhaus and all self-proclaimed deputy sheriffs
descr: to stop your attacks against us.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2019-12-05T05:39:00Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 04:44:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wyjud44ogor653to7gm3omdh32onfugl7wl33nbg7xila3s6a7vq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
10539edea332bd2b0a1c603801a445c2008a8574411803e66b7b79c4b0b8585e
NanoCore
4c98f097a7d17f8919c172ba7fe52b8600d8edd484ded4637dade9cbb9201c18
NanoCore
5349936f32f9d998a6b60cb20c1f8de9eca1f709d362877e2fe32d1a655310d2
NanoCore
5e450f5b1dcc1499278d77c4adffa991cb9795b8f9b2cf5ce9a684ee90052918
NanoCore
67fef2f83af3da398f5e144ccc65e18d7d30b57f53d94658cd62fe53d5e3d81b
NanoCore
6ba16889c485514ebaecaded7ef1b207f53d9ea0478492e32051adff9a491c5d
NanoCore
85eda0bfb0c5ef225846a360db05fad91f83aba3b5bda3f7b8ade56f7a875a7c
NanoCore
86e7c721f7fd48bd652d9a36a32e5744bd8ae0b02701f3d3086f9c7603a31369
NanoCore
b6512a533865ba3ca3a66e1eb66b8530fcf215e1f0d0372961f55b70fcf3ae3c
NanoCore
c068b1a7379f95ee883cd4ed9639bb2b28c380934f3bc0e0c7be97ad808c7b8a
NanoCore
+ 1'097 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-h8slfs77xe/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
91.193.75.137:1604
daviscoleman8999.ddns.net:1604
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 06b63e0e200fa86b1b63e84f433c9a1b16416d3071a61318c0145869d64d26a3

NanoCore

Executable exe b61341f38e33a3eeee6ef999b73067de9cd2d0cbfd97bdb426fdd0b06e5e07eb

(this sample)

  
Dropped by
MD5 adec63f4d0e22718f6475191ffda8197
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 06b63e0e200fa86b1b63e84f433c9a1b16416d3071a61318c0145869d64d26a3

Comments