MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5fb8844494411c36592bfa4a33e2d47daa7d01f52a6e12632f7865eb3f49024. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	c5fb8844494411c36592bfa4a33e2d47daa7d01f52a6e12632f7865eb3f49024
SHA3-384 hash:	b3f58aa817e500f9a24b77d820875af76743a9cfe05ac4c5b275cf775d98cb7221d101afab541d57c13cbf589442425e
SHA1 hash:	c0debf9f9bd13912910863aef3ef869c20b80ab4
MD5 hash:	65a0b315738fd8a5f7549cdbdea0e856
humanhash:	crazy-bulldog-maine-video
File name:	List of enquiry.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	1'436'160 bytes
First seen:	2020-05-11 14:26:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	24576:1tb20pkaCqT5TBWgNQ7a+S4KPCLUDG6OP5v46EzGLTXC+sqR6A:mVg5tQ7a+qPCLUD1OPGd6LTSO5
Threatray	1'933 similar samples on MalwareBazaar
TLSH	7D65D01273DE8361C7B25273BA66B701AEBF7C2506A1F86B2FD4093DF920161521E673
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: ace.centraloeste.com
Sending IP: 181.30.25.138
From: Mary Campbell <laura.aveni@centraloeste.com.ar>
Subject: List of Enquiry
Attachment: List of enquiry.img (contains "List of enquiry.exe")

NanoCore RAT C2:
u852117.nvpn.so:5638 (185.140.53.142)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-11 14:37:12 UTC

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yx5yqrcjiqi4gzmsx6skgprni7nkpua7kktocjrs66df5m7usasa._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

1064f65ca25e0759b7cebcd985a6243c98ccd08317df9f87dd1c8b88c29e2a9a

NanoCore

1c2fafc2031b76ab4caf3f91474f023321703a820209da4591192b6ca7cd09d2

NanoCore

2275ed4e7833bc3fc6ed7605de53e3ba46ceec5dd5e547fb8f49b977f9dfa0f0

NanoCore

582ec0985f0066dab40c455d1f8e6c414d9d5d0c156f673c6327efb901d97542

NanoCore

7170afaea1dbb708d92f335dbcbf2677704d6abb91cb6d3f08cca0ed470d3dac

NanoCore

8275f526465d7b9d806b1be78d895d7f499044b456be1aec36b8cac8188890ac

NanoCore

9480fd2481f1fdff9980c3364d5a33f8b3271e5566ca7d19329890c7c2dd20cd

NanoCore

a73359e756c28a176925f85e7aa0326213bbf54c5fea0dac86215341fa258cc6

NanoCore

a97cbea3af021993de44693e3dc76121041e99a3d21e4936f84341952e1464cd

NanoCore

+ 1'923 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201109-agxcav21z6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Drops startup file

NanoCore

Malware Config

C2 Extraction:

u852117.nvpn.so:5638
comcasted.duckdns.org:5638

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/