MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cacb2f55774ab3d5f1e89e164ea67bfa9b0f612a6e64dd8b31d062bec1d12cb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cacb2f55774ab3d5f1e89e164ea67bfa9b0f612a6e64dd8b31d062bec1d12cb6
SHA3-384 hash: 15e7282f18f43def7300bab6a321b739260c39e5c9271c1fb092375aa608e32b8708aa72acba9d7e7f908cac8768bda6
SHA1 hash: 0e70e8253e753153028c42b11afd7dbbc790fa35
MD5 hash: 0b3e38d2ac6ab696f6a760cf1c2290a6
humanhash: cardinal-wisconsin-march-quiet
File name:0b3e38d2ac6ab696f6a760cf1c2290a6.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:653'312 bytes
First seen:2022-05-27 20:12:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:ErHC+ooJtQJOCPI/w3a9073/E+fu5mt8Gvt40pd+oKjQqB1HKtb:8bfQBPt3E04Osmxvt406xBB1
Threatray 4'830 similar samples on MalwareBazaar
TLSH T1B5D41211696C8BAECC1D4639DC6521DC03F84D13BC52EB5BEE99B5DB1D333C2C221A6A
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.3% (.SCR) Windows screen saver (13101/52/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 1527452525654729 (2 x NanoCore)
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore C2:
87.251.79.109:48405

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
87.251.79.109:48405 https://threatfox.abuse.ch/ioc/642568/

Intelligence

File Origin
# of uploads :
1
# of downloads :
479
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
nanocore
Create hunting rule
ID:
1
File name:
0b3e38d2ac6ab696f6a760cf1c2290a6.exe
Verdict:
Malicious activity
Analysis date:
2022-05-27 20:13:30 UTC
Tags:
rat nanocore trojan
Link:
https://app.any.run/tasks/18e91345-04b4-4913-9989-5173b086ea68

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/275097/
Detection(s):
SecuriteInfo.com.Trojan.Siggen17.56737.11671.1544.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expand.exe obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/629130d13ec49f83a6d1ba36/reports/846461a9-03b5-4581-bad1-350220ff96b9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NanoCoreRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/817cf058-2599-404f-a539-93c78527c402
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1002933
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 635429 Sample: ryzD0Uu7KI.exe Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 68 logshostinc55.hopto.org 2->68 74 Snort IDS alert for network traffic 2->74 76 Found malware configuration 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 10 other signatures 2->80 9 ryzD0Uu7KI.exe 7 2->9         started        13 ryzD0Uu7KI.exe 2->13         started        15 dhcpmon.exe 2->15         started        17 dhcpmon.exe 2->17         started        signatures3 process4 file5 62 C:\Users\user\AppData\Roaming\KicNKkF.exe, PE32 9->62 dropped 64 C:\Users\user\AppData\Local\...\tmp779F.tmp, XML 9->64 dropped 66 C:\Users\user\AppData\...\ryzD0Uu7KI.exe.log, ASCII 9->66 dropped 84 Uses schtasks.exe or at.exe to add and modify task schedules 9->84 86 Adds a directory exclusion to Windows Defender 9->86 19 ryzD0Uu7KI.exe 9->19         started        24 powershell.exe 25 9->24         started        26 powershell.exe 24 9->26         started        36 3 other processes 9->36 28 powershell.exe 13->28         started        30 powershell.exe 13->30         started        32 schtasks.exe 13->32         started        34 ryzD0Uu7KI.exe 13->34         started        signatures6 process7 dnsIp8 70 logshostinc55.hopto.org 87.251.79.109, 48405, 49760, 49763 RISS-ASRU Russian Federation 19->70 72 192.168.2.1 unknown unknown 19->72 58 C:\Program Files (x86)\...\dhcpmon.exe, PE32 19->58 dropped 60 C:\Users\user\AppData\Roaming\...\run.dat, data 19->60 dropped 82 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->82 38 schtasks.exe 19->38         started        40 schtasks.exe 19->40         started        42 conhost.exe 24->42         started        44 conhost.exe 26->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        50 conhost.exe 32->50         started        52 conhost.exe 36->52         started        file9 signatures10 process11 process12 54 conhost.exe 38->54         started        56 conhost.exe 40->56         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cacb2f55774ab3d5f1e89e164ea67bfa9b0f612a6e64dd8b31d062bec1d12cb6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-23 21:45:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlfs6vlxjkz5l4pityle5jt37knq6yjknzsn3czr2brl5qorfs3a._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
0b1396805e736275f16550f3ecc5361cfcccc468094b4ea910ded8eaf430a5b3
NanoCore
263565e9f77b5ee48474855d471315dd56d1bcabe4d037fb380d404b3afcd14e
NanoCore
4525f8366e8c5c026a44cabbafd66c0dada4289009881a8a409080f1040ae99c
NanoCore
45272694709263868523b77d0561757378cc2e8aa7d64c7ed21deaacbdf88b5b
NanoCore
7709c1a46eff201524b42caaecba9ce963f7580e77d7b9c32059aaf3acfb248a
NanoCore
862965d573744607a29489905cfc8abdd8f187874d476ef4263eee7e5175630a
NanoCore
ddb292ac2c57e10703a5358532be2d46e4d5ea94361fd30be3c1e2bfb919621f
NanoCore
+ 4'820 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/220527-yzdwrsfbhk/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Checks computer location settings
NanoCore
suricata: ET MALWARE Possible NanoCore C2 60B
Malware Config
C2 Extraction:
logshostinc55.hopto.org:48405
127.0.0.1:48405
Unpacked files
SH256 hash:
0c1a88c5274f090e2808304f16bc895055e31abf3f17a92d1ad1d49bf24189b8
MD5 hash:
02f0bdc236e978b6f7019ed773e2e792
SHA1 hash:
e26a9ecd81b2cbd912e40d72643dcbc47b6a3270
Detections:
win_nanocore_w0
Create hunting rule
Link:
https://www.unpac.me/results/5c71a9f4-f3af-4fed-b658-33bb794f6bd8/
SH256 hash:
fdd10fb67e6276b3d848c92d4686f56b2ecbea1d629795a241ca6306a2f62d55
MD5 hash:
f20fd214bbda1a459a3eb415eec86017
SHA1 hash:
c658f61e4f308a69a4509649439814166c655e84
Link:
https://www.unpac.me/results/5c71a9f4-f3af-4fed-b658-33bb794f6bd8/
SH256 hash:
260b5fd8c93db7bf86e36b587079483233020e755074798ddbc40821a4afe0eb
MD5 hash:
13346af03b105b0b8f593724d6dc0c1d
SHA1 hash:
85c3722ba3a0cbe36b4a8997a9476bc498b7b3e7
Link:
https://www.unpac.me/results/5c71a9f4-f3af-4fed-b658-33bb794f6bd8/
SH256 hash:
3db90163db5a9d3b1975a5c47a2f909c8b69b57e786779e19e2c84987aaf8111
MD5 hash:
c37ef121b58d763cc4fca1d4089c9038
SHA1 hash:
773d4b70f7d0ac28cf1c39b6bb6cb4a433b95405
Link:
https://www.unpac.me/results/5c71a9f4-f3af-4fed-b658-33bb794f6bd8/
SH256 hash:
5e1a01cfcbbb52f4fbeddbe73fdc3c06cb8063f6cfcc37197bd5324060079b39
MD5 hash:
e4a84411ea8761db648f73b71feb9988
SHA1 hash:
084d593ad597a481d0aa5327128c3c9868627a7a
Link:
https://www.unpac.me/results/5c71a9f4-f3af-4fed-b658-33bb794f6bd8/
SH256 hash:
cacb2f55774ab3d5f1e89e164ea67bfa9b0f612a6e64dd8b31d062bec1d12cb6
MD5 hash:
0b3e38d2ac6ab696f6a760cf1c2290a6
SHA1 hash:
0e70e8253e753153028c42b11afd7dbbc790fa35
Link:
https://www.unpac.me/results/5c71a9f4-f3af-4fed-b658-33bb794f6bd8/
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cacb2f55774a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cacb2f55774ab3d5f1e89e164ea67bfa9b0f612a6e64dd8b31d062bec1d12cb6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/275097/

Comments