MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed6ea055c622adab41b5eba73b4d556c4c843b9e77e21933297ca0ce972ce5c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed6ea055c622adab41b5eba73b4d556c4c843b9e77e21933297ca0ce972ce5c4
SHA3-384 hash: e55a6570d49e81adde0a524a45096b4b7e25b539bcadd2587620fec50a2723f8661959e613e3e96e5e432cc445b81cf4
SHA1 hash: c2031a3b3873f0e2f520293aeed0d174b3c40ca5
MD5 hash: bfbecfdc60128b1dcea3a3aec61ed627
humanhash: mountain-winter-spring-october
File name:awator.net_xlmrp__nanoo.exe.malw
Download: download sample
Signature NanoCore
Create hunting rule
File size:668'672 bytes
First seen:2020-03-18 18:26:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:E6havD7kbCet40QUzQ+lBEhnsyyeHpqXpEpwoqjHdb9cwxS/ZLFUE:E6SkuQ40VBsnEecXp6sblI5F
Threatray 1'140 similar samples on MalwareBazaar
TLSH A0E41232FF90CE37CA8A9374783626243674D8C5F212DB270A582B683C977942D7DB95
Reporter ov3rflow1
Tags:malw NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Nanocore.23.12223.15166.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2018-12-12 18:04:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
09f20acd87a94d2a22202840d712eb5658471c2c39168d6178890ddcc313e9f3
NanoCore
21355c7eb596e21724d0a59545db0faf6219b858986cb5b0162201f54288ebb8
NanoCore
394674b4e655b4c844746da331510aecd02162402ee5a267eda539753eebd5e9
NanoCore
86432e782ec0089c5cc180a225cf8aff59409c0ef773c0e10e6ddf898b0508bd
NanoCore
91966b77a6acc2fd64c773d8797a505c40ecd272ebb4b44a5757990b5e4939c5
NanoCore
970f7d03e10292edf2d418d3f2c87a32a11c583ecf7c803917070bdbf136b0b1
NanoCore
d451e3e7766abda3a6406d3e52ed8d123daa52409bb7905a44694855fa923888
NanoCore
e583f88a5a2f0078444fa97cfd8b4357bce832202ec6140ade6239e7687c1850
NanoCore
ec9d801b120855fe926902234e77c60d5a0c8a115a977fe49e6b6b1539e0db51
NanoCore
ed544c300a04ddf77c6537f3cb78177f12c9a23e62d06189a19eee966caf9631
NanoCore
+ 1'130 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed6ea055c622adab41b5eba73b4d556c4c843b9e77e21933297ca0ce972ce5c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/186306/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments