MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cea1d36e04dc9357211734f659dfe352056afc40779ee251fee4e72ceec619bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 6

Intelligence 6 IOCs YARA 5 File information Comments

SHA256 hash:	cea1d36e04dc9357211734f659dfe352056afc40779ee251fee4e72ceec619bf
SHA3-384 hash:	3c1047f6e8fcaf46d31987df8fae32440f60cadb433ff22a1329c9c30b49d4f60ede8b1cf7e560bf7a7425777dac4724
SHA1 hash:	49ee48a6d3d81c22df6ca41aaeac61c4469b9437
MD5 hash:	6c44ccd3a852a5d1d43ed5d3387447ac
humanhash:	solar-seventeen-michigan-hotel
File name:	ORDER-5900.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	745'472 bytes
First seen:	2020-06-17 10:17:40 UTC
Last seen:	2020-06-17 10:24:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8eeec669d894212fb1f97c60d41a6bc8 (2 x HawkEye, 2 x NanoCore, 2 x AgentTesla)
ssdeep	12288:RXQnh0qccj0S0G5Vrfg2hHCmoQp7sat1xYH6BuxqJvjCh13B+clz:lgqcj0og2smoQBB1xYvCjCh1/z
Threatray	2'946 similar samples on MalwareBazaar
TLSH	62F4AE26E2D0C47FC3161779DD0BDF79AC26BED06AD825463BE8DC489F382913939192
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: copia.com.pt
Sending IP: 103.138.109.10
From: João Pinho <joao.pinho@copia.com.pt>
Subject: Order 5900
Attachment: ORDER-5900.zip (contains "ORDER-5900.exe")

NanoCore RAT C2:
185.244.30.128:4050

Hosted on nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.244.30.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-06-03T09:20:12Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/19499/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Gathering data

Threat name:

Win32.Trojan.DelfFareIt

Status:

Malicious

First seen:

2020-06-17 13:14:30 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=z2q5g3qe3sjvoiixgt3ftx7dkicwv7cao6poeup64ttsz3wgdg7q._file

Verdict:

malicious

Label(s):

nanocorerat

hawkeyekeylogger

NanoCore

6ee05acf3d5f5180f7c89274a4d8c5018b50b59b699f4eb13935db42b6646762

NanoCore

7404e34def5b0d893557483ab19926adc1635866bdfb0682adddc3caae877e03

NanoCore

8359e964cc6f542d0b069ece3e6529726d432b4946e054ac3b1c1bedcef2f7d8

NanoCore

8ef62131890ff8a17d38d8a48997e01252f605b68249ae4a321407be410680dc

NanoCore

a498ac74ffd2f4ceccc802b5a42f33e067a7eb6f0b2125c3cf3668dd5c0c7833

NanoCore

aaa969de94835c4f59740b9bc3463693142db72d094969962d353c6466c10cd5

NanoCore

bd21ef2fd03f08e64b61b4048bdcfdcbd7c61c869f32c5ea114d75afcbd94cc9

NanoCore

c968707cc9776419643ca1f0887a31954614629813f222ecc0e025b2efa3a815

NanoCore

ff5fb544251818945ba7b14fb0602d71188133caf7742871318291c91b474013

NanoCore

+ 2'936 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

keylogger trojan stealer spyware family:nanocore evasion

Link:

https://tria.ge/reports/200624-t6e3p6272a/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of SetThreadContext

Checks whether UAC is enabled

UPX packed file

NanoCore

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/