MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdbf3f2841bce578562e621e8015eacc7702b7489fca1e6c0bf7b3f8d61139b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdbf3f2841bce578562e621e8015eacc7702b7489fca1e6c0bf7b3f8d61139b4
SHA3-384 hash: f9abdd521c57223e72e2ee812062610bd39258e598f56c21ea4adb02ef87702442a31a077419a6c84033a7b3c38b6bfe
SHA1 hash: 1f05bb6a54fb81f9462ec699c89135f746546410
MD5 hash: b94a50a18b12307c470bd6be054f0423
humanhash: lake-quiet-pasta-yellow
File name:nano.jpg
Download: download sample
Signature NanoCore
Create hunting rule
File size:207'360 bytes
First seen:2020-10-13 15:40:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:gLV6Bta6dtJmakIM5WFmHi8ieZv00yRQ+E2cd:gLV6BtpmkFFmC83KWH2cd
Threatray 1'132 similar samples on MalwareBazaar
TLSH 8E14C01677A9462FE2DE85BDA1220202937CC2E7A8C3F3DB2CD855B65F563E10A471D3
Reporter srcr
Tags:HttpFileServer jpg NanoCore


Avatar
srcr
Sample source: http://groups.us.to:69/nano.jpg

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70545/
Detection(s):
Win.Trojan.Nanocore-5
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Sending a UDP request
DNS request
Using the Windows Management Instrumentation requests
Sending a TCP request to an infection source
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/490014
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Detected Nanocore Rat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bdbf3f2841bce578562e621e8015eacc7702b7489fca1e6c0bf7b3f8d61139b4/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2019-05-09 16:47:43 UTC
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xw7t6kcbxtsxqvromipiafpkzr3qfn2it7fb43al66z7rvqrhg2a._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
1f04a1a7e352faec6be52c5b658638190ecdeb2d2607429dbabd66e51f77b5d1
NanoCore
460687f7fdeb935f48f80949149c20e31b176ae6db9ab4b7398b0fbd0412920e
NanoCore
4edb517cd43eef725ea3c5dfeadec190b933e408ec6f8de0d093c18a80e8bef8
NanoCore
705d90649c0c2c0fe3c5939d2ec0309c3d0ec89c145b3e7da280e52a2361b588
NanoCore
760f1406027ffeb48694e12c4adb7842c216c0771eb08ca172c504078f2edace
NanoCore
82ff006af1f7c487ff9af214d33e71b4e0bf3cb2b02a428a54c5b8fc648e49b1
NanoCore
8ce08c8d5299a9b14573f34240c4ca253ad1e96247cbb3ee1346d51f44f2b21c
NanoCore
944b633d92799fe6aeefae5de7945b6b0b69020ed669d9d7e68ebd80868771e6
NanoCore
b4e0ba732f6ea2f91311f1734893509a774becd8ba18a73bd3a4d387b4f4b807
NanoCore
b5c0a89f74b62e5383ce300111541a706ac618a73a7b972df306a8c02f3dfd55
NanoCore
+ 1'122 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/201013-cwklel47zx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
groups.us.to:54984
Unpacked files
SH256 hash:
bdbf3f2841bce578562e621e8015eacc7702b7489fca1e6c0bf7b3f8d61139b4
MD5 hash:
b94a50a18b12307c470bd6be054f0423
SHA1 hash:
1f05bb6a54fb81f9462ec699c89135f746546410
Detections:
win_nanocore_w0
Create hunting rule
Link:
https://www.unpac.me/results/e0fdc75f-41f2-4c71-a623-ef717899eed0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bdbf3f2841bce578562e621e8015eacc7702b7489fca1e6c0bf7b3f8d61139b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/70545/

Comments