MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c368965b728a67b0dba3ad94a563259b056f84a7a7cc4a02a9ded069c8909afc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c368965b728a67b0dba3ad94a563259b056f84a7a7cc4a02a9ded069c8909afc
SHA3-384 hash: 3ce48c9643ad1e11b23b050a60b0a9f77847814a922d919dd226b58f27543a296ae9910b0b7f17ef40ce638a1c6191b3
SHA1 hash: 45f8ecd31e0892b7f74657e3f24ea9f1d3b3b043
MD5 hash: 9c81a69a798d2300a5f8365a3ed5dcbc
humanhash: floor-echo-jig-virginia
File name:7fdd8bee3aa7d401f84ac7c772c8de07
Download: download sample
Signature NanoCore
Create hunting rule
File size:826'880 bytes
First seen:2020-11-17 11:25:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 230f024031d7c58ce0df197af9c448f0 (25 x AgentTesla, 17 x Loki, 16 x NanoCore)
ssdeep 12288:sUy3v7U2lXyOCgcmAba+3jBe1yblzjPix8zycDl3P8dbewLwz+E+/ljNo:sUMHXyOCgcmAbZBTbljPpzzFgTs6E+U
Threatray 165 similar samples on MalwareBazaar
TLSH 3005BF33E2905437D2A32A3C8C4BA7649835BD113D28E9463FF71D4C9F39A616AB5393
Reporter seifreed
Tags:NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Unauthorized injection to a recently created process
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
DNS request
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c368965b728a67b0dba3ad94a563259b056f84a7a7cc4a02a9ded069c8909afc/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:26:18 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ynujmw3srjt3bw5dvwkkkyzftmcw7bfhu7geuavj33igtseqtl6a._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
24111fff96ab8f32f2ae29aba09ede3cd730cbecd8be2fe37e31d509308d1b2c
NanoCore
2a65f2f28768640478a8f5b6b8ee689c4045bbfa123418c3f158d83d1c54a485
NanoCore
366bac9db38e89bd47b0128bdf62a4f986d1d27449c12920744e157b819751f1
NanoCore
9d02fdf85e629f46ced643ac5bc31dd9e1c5c733f9e2b1c5e58d1e0126094ed9
NanoCore
c1c841ab92fcc7f486280ba17d8e08dfd8626c2b7adad80bc83bd27794dde5e6
NanoCore
db256170f60efdebefa6673fd5e985a7688c3ea5656aa827a61b9f3c600d0b00
NanoCore
eb301ee5bae45a4d93e8c88a0bfda61e962be4c5a5c00255ebdf5aa364f69341
NanoCore
f304855a11aedd539b9bdb686b1d5781e0d7080560f9520c6bda8586947b3285
NanoCore
f697be16aa01caad20d538c2864f0ee7163659c3985636b8de37a1431ad95f90
NanoCore
fc7a4ad26af13010c1384a649199dd88c1350f062e127d939805ef2bfa8b2eb5
NanoCore
+ 155 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/201117-dphelvfcqa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Drops startup file
UPX packed file
NanoCore
Malware Config
C2 Extraction:
:2000
malam.ddns.net:2000
Unpacked files
SH256 hash:
c368965b728a67b0dba3ad94a563259b056f84a7a7cc4a02a9ded069c8909afc
MD5 hash:
9c81a69a798d2300a5f8365a3ed5dcbc
SHA1 hash:
45f8ecd31e0892b7f74657e3f24ea9f1d3b3b043
Link:
https://www.unpac.me/results/045a25f2-7440-46e6-b32f-75ee3c4f76f9/
SH256 hash:
1e4a50ccd28d9b4f3c1f4407fe52a723e98c3cbb6cf96ee40fca7e86c93a9b5e
MD5 hash:
326f76c410e8e9b3bee10fd868c569d1
SHA1 hash:
4ac5cc9eb43868853efdb10b02f56992bc85cd95
Detections:
win_nanocore_w0
Create hunting rule
Link:
https://www.unpac.me/results/045a25f2-7440-46e6-b32f-75ee3c4f76f9/
Parent samples :
f087b1eb1cd66a15b35640b1e95b20e891a4ee65072e93c32cc32b49a15a70aa
4c71595d250b18942810ce22bed924d1164d35457a29399b2e9f1a9af9c3d5ad
b57f10a57099269df869e247bc38a365569a50edf4c05d258820f3348c6ecf9f
6788274e025b323c119a33256c2fb0ebe4d866778e24ee235c1a9152386f316b
24111fff96ab8f32f2ae29aba09ede3cd730cbecd8be2fe37e31d509308d1b2c
fc7a4ad26af13010c1384a649199dd88c1350f062e127d939805ef2bfa8b2eb5
c368965b728a67b0dba3ad94a563259b056f84a7a7cc4a02a9ded069c8909afc
SH256 hash:
38b8d553c889fcae4dd4bdc2520bd53ad3de0657b569abf05e9028b628667c00
MD5 hash:
16668b1f39dd23137a094c7632dcaab2
SHA1 hash:
c514b3d34acd84c1fe1795dcb249e165aa57bbf3
Detections:
win_nanocore_w0
Create hunting rule
Link:
https://www.unpac.me/results/045a25f2-7440-46e6-b32f-75ee3c4f76f9/
Parent samples :
f087b1eb1cd66a15b35640b1e95b20e891a4ee65072e93c32cc32b49a15a70aa
4c71595d250b18942810ce22bed924d1164d35457a29399b2e9f1a9af9c3d5ad
b57f10a57099269df869e247bc38a365569a50edf4c05d258820f3348c6ecf9f
6788274e025b323c119a33256c2fb0ebe4d866778e24ee235c1a9152386f316b
24111fff96ab8f32f2ae29aba09ede3cd730cbecd8be2fe37e31d509308d1b2c
fc7a4ad26af13010c1384a649199dd88c1350f062e127d939805ef2bfa8b2eb5
c368965b728a67b0dba3ad94a563259b056f84a7a7cc4a02a9ded069c8909afc
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments