MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e35ab3004ad18225368bdb2f19a8b07fb00ae3e74251f555f4cb6bcd27939a43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e35ab3004ad18225368bdb2f19a8b07fb00ae3e74251f555f4cb6bcd27939a43
SHA3-384 hash: 926fe0e65d0a11094868e0086e980ee1a7ccd442907a0ff41a577415685a93199261f53ca08dcdda795f239351ec0d08
SHA1 hash: 4514b4cfdcc7b178aa0e0b6245be2f0757e7e36a
MD5 hash: 537644a8d041efac33a4fbaebbba7945
humanhash: early-earth-august-white
File name:e35ab3004ad18225368bdb2f19a8b07fb00ae3e74251f555f4cb6bcd27939a43
Download: download sample
Signature NanoCore
Create hunting rule
File size:663'552 bytes
First seen:2020-03-23 16:26:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7d31a919443d9b9bd734d66f1631c0c0 (1 x NanoCore)
ssdeep 6144:9G/p6HCmbtwk3ZdK1qT/OJNY6QXAeFbh5AfCR/DJyjmYsq4pSw9CsuayU0:dHUkJd0cbcoDJyaS4pSQCsua50
Threatray 1'107 similar samples on MalwareBazaar
TLSH 1EE4AD61F5819E96CEE842B6F5661D845E23B22448E35E2F215831EFD813B84CE387FD
Reporter Marco_Ramilli
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Genkryptik-7086920-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2019-07-30 01:26:54 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0f73e9d58b85ae9061722f0720ab2f76f9884042b9ac260e5c102564d4572004
NanoCore
349c6730ddc5b8a6969dadbda237829f6cf52f57101ecb03adbb4024df5da299
NanoCore
45bd070ecdb312c1f7b26ffefc4c122b4f3d373b75bf7dd2628a37407b29cad6
NanoCore
54d7bb96a72dc01cfc92a11805ecbd13d7e3c5b8f38bee450d164a5f19e7cef6
NanoCore
66b8f85747edc77fbfabe6b383e11e5284b185dab2257b7c2a127fbfda839edc
NanoCore
70bdde448d83d5fabecafc0b3706fe1b732b64ee09d6d34886415688acf459d3
NanoCore
76edf0ebea99cf07ff5bb900193c4efa05e971c2bc2097ec70d5e54ad7b3dce8
NanoCore
a30738760b8787a51d134470d53a01d3a970869a03e143514fdfa68ab6436fe6
NanoCore
a3ed1e39585437ad004be13cc5f71865ba99a6e558e4acaf632ea4c94cf2ea5c
NanoCore
a5e7773e86e1f8feacc75ced3053ac3d44af73d5b2ec72005c7ba2cd465f1ef3
NanoCore
+ 1'097 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NanoCore

Executable exe e35ab3004ad18225368bdb2f19a8b07fb00ae3e74251f555f4cb6bcd27939a43

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/219381/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments