MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4491a0d3030a3c03f75f931bb5f532b6064feb927a9664bda88c675d480b77c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4491a0d3030a3c03f75f931bb5f532b6064feb927a9664bda88c675d480b77c
SHA3-384 hash: 910770311291a7703210a312dfdce9f3027e582d5e789a0392b58a0124de9671af96498dabe6ab7e9a38f4d349905e25
SHA1 hash: f7fc77f905bc1a674726d9f3d21278f881ec0b22
MD5 hash: e5ec145d3d05ebc0c35b71e2191a0026
humanhash: tango-california-timing-low
File name:e4491a0d3030a3c03f75f931bb5f532b6064feb927a9664bda88c675d480b77c
Download: download sample
Signature NanoCore
Create hunting rule
File size:270'848 bytes
First seen:2020-07-06 07:07:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:EZW2mDkIMhoOyGRiEW+/oF8lcKlF+V0r4B3BVOW7WSCIttKagQ:lDkKO7Rk+/oGv+9B3Z7W3PQ
Threatray 1'118 similar samples on MalwareBazaar
TLSH 21448C997FB99962CEA79F325D9200DC43A1CC236A43E3C195B836ED1C913DA6D0C8D7
Reporter JAMESWT_WT
Tags:NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/21061/
Detection(s):
SecuriteInfo.com.Variant.Adware.BrowseFox.62.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Enabling the 'hidden' option for analyzed file
Creating a file in the Windows subdirectories
Unauthorized injection to a recently created process
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Creating a file in the %temp% directory
Launching a process
Deleting a recently created file
DNS request
Connection attempt
Setting a single autorun event
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Enabling autorun with Startup directory
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e4491a0d3030a3c03f75f931bb5f532b6064feb927a9664bda88c675d480b77c/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 23:02:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4rerudjqgcr4ap3v7ey3wx2tfnqgj7vze6uwms62rddhlveaw56a._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
036c0fbb1ffb23e9bfd4b4834a396d79ec319078865adf3ef75418450cf9fd18
NanoCore
1cef46cbb22cfda50b0e93dadedfb09f511b80e802d239270c96954a38d11f28
NanoCore
3521a9cd1d18d9991b29966ae472097ae2996fc50c230ac06762f9e7666656f5
NanoCore
4de20c38ffff3f9d75d9a446f152c017d9010477c28c8b97875f95f448ecb761
NanoCore
5d4d3a449bd4ed7a879d585c182bad5d7f0ee24d04bc862e5043c344f2bd6f86
NanoCore
7943dd3d1f4215ee40123ab13edc945dccd0ff9d3e9cddf372ff8ecbffe62635
NanoCore
bf5d5c28bec7bdcf41fad771fd465ba6bb9a56e053c9470a6e10293466109d3c
NanoCore
e29e9d9beb5ce8187decf038cdc0b1d3102b4cfe43715a3b4f934098a943ebed
NanoCore
e34ce3660cbabe945aadb571016cbd7e73ca4a7baa6e9cd64a3615b6474ccdc8
NanoCore
fadcffc72696cb639334be446d2aeb90743b270276f48b730efbb59b73505a85
NanoCore
+ 1'108 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:nanocore persistence evasion
Link:
https://tria.ge/reports/200706-lydxzxqdrs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Drops file in Program Files directory
Suspicious use of SetThreadContext
Drops file in System32 directory
Checks whether UAC is enabled
Adds Run entry to start application
Loads dropped DLL
Executes dropped EXE
NanoCore
Malware Config
C2 Extraction:
dontreachme3.ddns.net:3603
dontreachme4.ddns.net:3603
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/21061/

Comments