MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d177132fa7941febe11431bb8dd897e86464eaac755b8e693ceba29be0f90afa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d177132fa7941febe11431bb8dd897e86464eaac755b8e693ceba29be0f90afa
SHA3-384 hash: 5fb820d1af4b2d2d485e84b2f46ca066324ffaf7a1b7df2e4e2eab33611cb44e405b5dce7d6ba633983d242bed91dc16
SHA1 hash: c930f9e7ba1e3294aa33d462735afa9532c9d70d
MD5 hash: ade15be58f8f6f951c4176523853362c
humanhash: high-golf-mobile-april
File name:ade15be58f8f6f951c4176523853362c.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:632'320 bytes
First seen:2020-07-16 18:39:27 UTC
Last seen:2020-07-16 20:12:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'754 x AgentTesla, 19'662 x Formbook, 12'252 x SnakeKeylogger)
ssdeep 12288:P2GwEH3NZONN4VcCwuEoYwBvsELAwS6D2s7sWUzwisZ:PzTXPONN4Vc2mwBUELjS6D2eUzwisZ
Threatray 1'173 similar samples on MalwareBazaar
TLSH 5FD4028B12D04658C14CCABD0975C1B642B9CE391A97F6062FD53C9B3FF23DA2E4652E
Reporter abuse_ch
Tags:exe NanoCore nVpn RAT


Avatar
abuse_ch
NanoCore RAT C2:
185.244.30.251:5600

Hosted on nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-HU
country: HU
descr: Budapest
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-07-14T13:30:36Z
source: RIPE

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/26964/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WOX.20055.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/388752
Signature
.NET source code contains potential unpacker
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 246550 Sample: pxJkeLvCWl.exe Startdate: 18/07/2020 Architecture: WINDOWS Score: 100 91 Found malware configuration 2->91 93 Malicious sample detected (through community Yara rule) 2->93 95 Multi AV Scanner detection for submitted file 2->95 97 5 other signatures 2->97 14 pxJkeLvCWl.exe 1 1 2->14         started        17 pxJkeLvCWl.exe 1 2->17         started        20 pxJkeLvCWl.exe 2->20         started        22 wpasv.exe 2 2->22         started        process3 file4 115 Maps a DLL or memory area into another process 14->115 24 pxJkeLvCWl.exe 1 14->24         started        27 RegAsm.exe 1 8 14->27         started        79 C:\Users\user\AppData\...\pxJkeLvCWl.exe.log, ASCII 17->79 dropped 31 RegAsm.exe 17->31         started        33 RegAsm.exe 2 20->33         started        35 RegAsm.exe 20->35         started        37 conhost.exe 22->37         started        signatures5 process6 dnsIp7 107 Maps a DLL or memory area into another process 24->107 39 pxJkeLvCWl.exe 24->39         started        42 RegAsm.exe 3 24->42         started        87 185.244.30.251, 49717, 49718, 49719 DAVID_CRAIGGG Netherlands 27->87 89 79.134.225.12, 49720, 49721, 49722 FINK-TELECOM-SERVICESCH Switzerland 27->89 83 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 27->83 dropped 85 C:\Program Files (x86)\...\wpasv.exe, PE32 27->85 dropped 109 Hides that the sample has been downloaded from the Internet (zone.identifier) 27->109 file8 signatures9 process10 file11 103 Maps a DLL or memory area into another process 39->103 45 pxJkeLvCWl.exe 39->45         started        48 RegAsm.exe 39->48         started        81 C:\Users\user\AppData\...\RegAsm.exe.log, ASCII 42->81 dropped signatures12 process13 signatures14 113 Maps a DLL or memory area into another process 45->113 50 pxJkeLvCWl.exe 45->50         started        53 RegAsm.exe 45->53         started        process15 signatures16 99 Maps a DLL or memory area into another process 50->99 55 pxJkeLvCWl.exe 50->55         started        58 RegAsm.exe 50->58         started        60 RegAsm.exe 50->60         started        process17 signatures18 105 Maps a DLL or memory area into another process 55->105 62 pxJkeLvCWl.exe 55->62         started        65 RegAsm.exe 55->65         started        process19 signatures20 117 Maps a DLL or memory area into another process 62->117 67 pxJkeLvCWl.exe 62->67         started        70 RegAsm.exe 62->70         started        process21 signatures22 101 Maps a DLL or memory area into another process 67->101 72 pxJkeLvCWl.exe 67->72         started        75 RegAsm.exe 67->75         started        process23 signatures24 111 Maps a DLL or memory area into another process 72->111 77 RegAsm.exe 72->77         started        process25
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d177132fa7941febe11431bb8dd897e86464eaac755b8e693ceba29be0f90afa/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 13:04:54 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2f3rgl5hsqp6xyiugg5y3wex5bsgj2vmovny42j45orjxyhzbl5a._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
485868eac79a5a53120af21c63d317cc033ff0855da3684f16c30753a8d961c2
NanoCore
49734ef67be2f2a71545820ed6258683d03a9aa3a97db586aea7d148090b4fa4
NanoCore
8caedefa8cf9273522057503dc8c9cabeaea4eb113a612040f1da56f8d85dbbf
NanoCore
ad9b31618184bb980a5e825fcb465913f3002077043fc5e3a761653473a4dce0
NanoCore
baf5098a21b4d571d2c23727229db27ee1c81216aeddbe59ee391f94154ca33d
NanoCore
c660d1d93adc735a9a5c59d18eecf6c4124b4e32b3a704bb754e490a2bf5eb35
NanoCore
cf2ae6336471a78f6df77e11aaf70256bbdf16c64392c615e1ab2b3fbacce71a
NanoCore
f1fddc0cfd9632772ba10b059d83a1bb34b01a81766e61804bc39ca3898c5211
NanoCore
f9614b985dcb06d9c40448e4ecf1a94ce2cd69e54f6acbeca7b6deec54aafdb3
NanoCore
fa8b5da63665ba268ec6923aa0bd26662e9dea318d80a7ab659065724c94868a
NanoCore
+ 1'163 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
persistence evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200716-zsd13kesgn/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Adds Run key to start application
NanoCore
Malware Config
C2 Extraction:
185.244.30.251:5600
79.134.225.12:5600
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NanoCore

Executable exe d177132fa7941febe11431bb8dd897e86464eaac755b8e693ceba29be0f90afa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/413096/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/26964/

Comments