MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8e2713744ae4bf75f6f051a88fd7cd88aa5a9d0e5707932b44a5fb47dd73057. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments

SHA256 hash:	b8e2713744ae4bf75f6f051a88fd7cd88aa5a9d0e5707932b44a5fb47dd73057
SHA3-384 hash:	cebcc0cf5b327647f13f89ca787d44850e397eee2521ec9b180165e16c777af738bd3b6e19d1bdef006d5a20026ac865
SHA1 hash:	a95fdb376bc3094ea99d7077107ca3608114d019
MD5 hash:	02ba4b1f147403d1713d7cea04069775
humanhash:	florida-zebra-mexico-table
File name:	factura.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	677'888 bytes
First seen:	2020-07-21 16:19:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:DGnDPdPS9FpnS/Yxf916n9cJ9osrHd8b/rfv02y3dIhFG2+6w:Y6sYxiwJJ8Xv0v3dIhFG2M
Threatray	1'836 similar samples on MalwareBazaar
TLSH	A3E48D00FBF485CAD36A1F7AD87141409675F95BABE6E38B2B84F6AD18533588703F12
Reporter	abuse_ch
Tags:	ESP exe geo NanoCore nVpn RAT Santander

abuse_ch

Malspam distributing NanoCore:

HELO: vps.uncethsa.com
Sending IP: 45.95.170.154
From: Paula Gonzalez <info@uncethsa.com>
Subject: Re: Santander - Transferir seu favor, por Telecrédito
Attachment: factura.r11 (contains "factura.exe")

NanoCore RAT C2:
tgfhgfd.casacam.net:6331 (185.165.153.8)

Pointing to nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacyfirst.sh'

inetnum: 185.165.153.0 - 185.165.153.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-AT2
country: AT
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2020-07-14T13:31:45Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/30290/

Detection(s):

SecuriteInfo.com.HEUR.QVM03.0.B79F.Malware.Gen.1571.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a window

Result

Threat name:

Nanocore

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/393513

Behaviour

Behavior Graph:

Download SVG

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/b8e2713744ae4bf75f6f051a88fd7cd88aa5a9d0e5707932b44a5fb47dd73057/

Threat name:

ByteCode-MSIL.Trojan.MassLogger

Status:

Malicious

First seen:

2020-07-21 16:21:06 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xdrhcn2evzf7ox3paunir7l43cfklkoq4vyhsmvujjp3i7oxgblq._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

2352a7cd00ed5221c4b807670ca01f49f76beb5dea868d8db38b1fcc0e362c18

NanoCore

23fb5bf57b70184335261dec8c9bd0976ef8c61d843486ffdc5692aa9618e58e

NanoCore

2a828598f4c66e85305d93ce56bad4c27b7bd6a446eb9b9cec27d961b2591b95

NanoCore

68f8acac4c0dfc81929e6ed2b67a306c5dab1606c377be8b5d6f35d8fc50dad0

NanoCore

a0086dfee2dba4d6a0adab05e848cfbb9755f68be7adef3ff35ff9740e5a1c2e

NanoCore

af8343cc25fb243e378897bcf5c22ff94287610ae86538862feb362e2382b456

NanoCore

c3ca6a64f95f07e7557eb0ed7968c7d7bf735b08478f517061542059930bbf32

NanoCore

d7f94abc222e9d72d3878ee97d3c257878e724bdb83e0ea9e92fc202d992be41

NanoCore

f94fdbaf430c51b2d97e75c378a7e6cf66fbbe6984cc9348b9369a435fdaa2b1

NanoCore

+ 1'826 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

keylogger trojan stealer spyware family:nanocore evasion

Link:

https://tria.ge/reports/200721-tjlda8lq62/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetThreadContext

Checks whether UAC is enabled

NanoCore

Malware Config

C2 Extraction:

tgfhgfd.casacam.net:6331

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b8e2713744ae4bf75f6f051a88fd7cd88aa5a9d0e5707932b44a5fb47dd73057

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/