MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb5eb4758a41046a2f3fc084731d756aedf8ea212dc08c9bb2e6cd7f5eff6cae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	cb5eb4758a41046a2f3fc084731d756aedf8ea212dc08c9bb2e6cd7f5eff6cae
SHA3-384 hash:	765f6179ce1aa14e2f7e4c34d0ba4adb9bd04cb6ea4a44f5785c6c91b7046331a7e1a6fe82835de70c805891b3aa49c5
SHA1 hash:	aad5682a4c9798a81ca7ab34a87f281c8df77f4f
MD5 hash:	cdb11d14d3d4d9629af79ca24674574b
humanhash:	washington-charlie-ceiling-maryland
File name:	final bill copy 28.6.2020.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	330'240 bytes
First seen:	2020-06-29 07:36:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	6144:6w9LKRcqSGjUkVP0H6JBh2dxPzH7PetJiRE6ta5vj:6w4+GjF5JB0DPHRE
Threatray	1'424 similar samples on MalwareBazaar
TLSH	FF64C0216BE8433EEAEF6B7CE5364525033173853B23F78B4B38F18D9A5538581426B6
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: masterall10.rapidns.com
Sending IP: 180.149.242.95
From: Export <exports@inmaenterprises.com>
Subject: final shipping bill copy // INMA RE: Shipment for Amsterdam In001
Attachment: final bill copy 28.6.2020.zip (contains "final bill copy 28.6.2020.exe")

NanoCore RAT C2:
officezafar.hopto.org:3575 (79.134.225.105)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/15780/

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/cb5eb4758a41046a2f3fc084731d756aedf8ea212dc08c9bb2e6cd7f5eff6cae/

Threat name:

ByteCode-MSIL.Ransomware.TeslaCrypt

Status:

Malicious

First seen:

2020-06-29 07:38:06 UTC

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=znpli5mkiecgulz7ycchghlvnlw7r2rbfxaizg5s43gx6xx7nsxa._file

Verdict:

malicious

Label(s):

nanocorerat

hawkeyekeylogger

emotet

NanoCore

38701fe4b63d1436ba2e26cc7e268327299b58bcccbf074bfb2cbbcf57ceb2ea

NanoCore

4c4881464fd7d95cfe2d60dfd7beff8dd9c3426c15c945500db1e8714374556c

NanoCore

4cc5f468994fd62cc832482404cfc7e45232f059b9d355d3df41535a170b3470

NanoCore

6066b9b33c7336497e3fe0b7b0eb04c8fa8d27accdaad763658cd29865b2236e

NanoCore

90474a0270106b33e3208a63041d2e4d013b1d2b415bf3bf44e9a5ab685d0531

NanoCore

a97cbea3af021993de44693e3dc76121041e99a3d21e4936f84341952e1464cd

NanoCore

ae9576df43dd4f5e8d48c6774e7bbbd1a6baaad219c4022dd49af9fdaec57d61

NanoCore

be1a45ae85bb530727a5e96d3dc19eeb0542991ddb5a747b93665b4599c70ea0

NanoCore

e4174e1702d046eb696fb13f9d7be26c7b519179ac94212ce61de97ed586cf10

NanoCore

+ 1'414 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

spyware evasion trojan keylogger stealer family:nanocore persistence

Link:

https://tria.ge/reports/200629-eegexdlww2/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Drops file in Program Files directory

Suspicious use of SetThreadContext

Adds Run entry to start application

Checks whether UAC is enabled

Reads user/profile data of web browsers

Deletes itself

Uses the VBS compiler for execution

NanoCore

Malware Config

C2 Extraction:

officezafar.hopto.org:3575
79.134.225.105:3575

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/