MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf
SHA3-384 hash: bb470abb87149d5c952e5e434cf5670e26e3b92ccdf813e30d57319bdd28e6f03b1ff2a88b0d609f3050a22dcde66976
SHA1 hash: fd18d24771192aca0cb6f200b851f21e88ce63ab
MD5 hash: 110b8fb575591602bc3d793cbe51edde
humanhash: quebec-oscar-victor-table
File name:Zsd~reet_02987635367-03987635637.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:805'888 bytes
First seen:2022-01-17 09:27:50 UTC
Last seen:2022-01-17 11:50:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:etwsXzkzFWiHIioDSJQ+uWBH1vbjmJdSjUGDymQcz5P7:eesXzXiHI34Q+GD4v+mQcdP7
Threatray 3'780 similar samples on MalwareBazaar
TLSH T152059D232654525ADCFDA77A4038360853F579C6B707CEC97DE4212E1EB3F412FA2A1A
File icon (PE):PE icon
dhash icon 6cccc4e4e4e4dcc4 (2 x NanoCore, 1 x AgentTesla, 1 x SnakeKeylogger)
Reporter Anonymous
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Zsd~reet_02987635367-03987635637.exe
Verdict:
Malicious activity
Analysis date:
2022-01-17 18:02:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9ec4a70a-3510-458d-965a-53f8340758d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/219781/
Detection(s):
SecuriteInfo.com.Variant.Ser.Strictor.1562.15733.3232.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
DNS request
Running batch commands
Creating a file
Launching a process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/61e536ab0f8c757253c3caf8/reports/58458e0a-e964-45f5-9082-308ea4e6fc22/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a65a7844-575f-47bc-9e59-b7b5511a98d1
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/921700
Signature
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2022-01-17 09:28:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
107
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2qa45txzg4o3gfhttvoex42fonanpptpbkwgyyntzustccu57lpq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
0b1396805e736275f16550f3ecc5361cfcccc468094b4ea910ded8eaf430a5b3
NanoCore
30e1ba61a63a27b668eee09f960a83d944e878c33b46f85ea86bacdf1427f4dd
NanoCore
3b423344c5fff0aee78a4802681bac29d85c0b5edc1761caf455dc6bf0fce59a
NanoCore
4f97e52ca46091f7651cfebc671b00a7c8c1abd92e2b532eb141c0266eecb2f0
NanoCore
8bf0518cd0c607aa51073dfe422f6af43ab8b43523bd0c182cc6172c9ecb9072
NanoCore
8de953938b8fb2d222892012da5758cefe50de064f61416c2bc2c6e6f019352c
NanoCore
acc1c22f2003ccec8114d0cf6f022836c8e00ab0e895a6a59f6a11cdec2db3b4
NanoCore
+ 3'770 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220117-lfchdahebk/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops startup file
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
373ecebfcd740da14d1fa114a15b08af91f4e2a524e1317af07e952c904890f0
MD5 hash:
7d640ef18f4fbb737fdbec6885bb1682
SHA1 hash:
a7197370dd3372c66d2da9b3f851c2801e705b43
Link:
https://www.unpac.me/results/ccb83ce6-23f4-44ad-826b-2251f6775eeb/
SH256 hash:
c37fe0ecabced7718f93f3c1c057b5a153e1f792cb03cec68d3cc6337008a44f
MD5 hash:
8d80c11816f44f8c1b6bd7de62ae306e
SHA1 hash:
7cbe291ba9ba30519bb12ce8ff02595b9e107dd1
Detections:
win_nanocore_w0
Create hunting rule
Link:
https://www.unpac.me/results/ccb83ce6-23f4-44ad-826b-2251f6775eeb/
SH256 hash:
e036660b56e1439cf1706f557444222038a1da26190dffe5c27e9ea006cd1708
MD5 hash:
4d1b753a65eda9b108806b70e17f85d0
SHA1 hash:
4018fd3cb7f05868618be82c7498028dd79aab75
Link:
https://www.unpac.me/results/ccb83ce6-23f4-44ad-826b-2251f6775eeb/
SH256 hash:
d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf
MD5 hash:
110b8fb575591602bc3d793cbe51edde
SHA1 hash:
fd18d24771192aca0cb6f200b851f21e88ce63ab
Link:
https://www.unpac.me/results/ccb83ce6-23f4-44ad-826b-2251f6775eeb/
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d401cecef937/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/219781/

Comments