MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f48765a1f0d8935608acea2058dbe36d76358a835320110fa9d6b6ff15ef0882. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	f48765a1f0d8935608acea2058dbe36d76358a835320110fa9d6b6ff15ef0882
SHA3-384 hash:	db6f94925f236ab761ff6a2c1d30d6f1518b017f4a7f28b9cccf91958e086c776a580bfb05fbcf6956c262b8c4fe4454
SHA1 hash:	ee16ed9f24ba5cb4a0f601bb0503191d48389799
MD5 hash:	c1d1a4779b83db2074a7f91fdc8ea860
humanhash:	harry-india-coffee-fish
File name:	Vía notificación de envío del servicio de mensajería.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	408'576 bytes
First seen:	2020-06-25 07:11:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	6144:Z7tdQebZIqW0YzAOLlWojjOq8+0osId7PPAchQFbraIeQB+p:Z7PDZKzA8rjSq8+0osIVPX+raIeQC
Threatray	1'141 similar samples on MalwareBazaar
TLSH	F794F21437AC2B15D5FD477910F2A18407B876AB3233E74E4E84729C2DA3BD6C622767
Reporter	abuse_ch
Tags:	ESP exe geo NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: vps.yidagnp.com
Sending IP: 45.95.169.73
From: VIA RECIBO IMPRESO SERVICIO DE CORREO <info@yidagnp.com>
Subject: Re: Vía notificación de envío del servicio de mensajería
Attachment: Vía notificación de envío del servicio de mensajería.r11 (contains "Vía notificación de envío del servicio de mensajería.exe")

NanoCore RAT C2:
185.244.29.128:9995

Hosted on nVpn:

% Information related to '185.244.29.0 - 185.244.29.255'

% Abuse contact for '185.244.29.0 - 185.244.29.255' is 'abuse@gerber-edv.net'

inetnum: 185.244.29.0 - 185.244.29.255
netname: GERBER-NETWORK
descr: Wonsan, Kangwon-do
descr: Choson Minjujuui Inmin Konghwaguk
country: KP
admin-c: GN5022-RIPE
tech-c: GN5022-RIPE
org: ORG-GN148-RIPE
status: SUB-ALLOCATED PA
mnt-by: GERBER-MNT
created: 2018-01-31T19:41:57Z
last-modified: 2020-04-06T22:16:40Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/13961/

Detection(s):

SecuriteInfo.com.Generic.mg.181bf63f744587d9.5579.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Creating a file

Creating a file in the %AppData% subdirectories

Connection attempt

Enabling autorun with Startup directory

Unauthorized injection to a system process

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/f48765a1f0d8935608acea2058dbe36d76358a835320110fa9d6b6ff15ef0882/

Gathering data

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6sdwlipq3cjvmcfm5iqfrw7dnv3dlcudkmqbcd5j223p6fppbcba._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

682be0853ccd6f60deb69d27941a628758c4e13e7d2e6ee95a95f415f3a9f0c6

NanoCore

81e1de07d01df7e919a463ace47bd9416c3e6ac1b43526c971178441dc351170

NanoCore

85eda0bfb0c5ef225846a360db05fad91f83aba3b5bda3f7b8ade56f7a875a7c

NanoCore

974c0a579fffd3e9bff886a850a48a3c8b77e716139d6d0e30902fed9dd53e0e

NanoCore

b3b166163e59a2f0f5b8bea9aaa6ea107b86bb9767362abcdf5cf7f1818cebd3

NanoCore

be39cd2009d58faaf2e47de4717b5a4d59df17cc1f0850f299c8388ab3d3bb42

NanoCore

eac11eb18f66b5d563093f88c67cf5f43e1fb90d26ca99664321051f8724bc7d

NanoCore

f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb

NanoCore

fe8b7dfe8bc6cf9d0bf54942b5bdb15a1f24cc9fd7b2f680413ec97885ec1118

NanoCore

+ 1'131 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

evasion trojan keylogger stealer spyware family:nanocore

Link:

https://tria.ge/reports/200625-exghjq5ktn/

Behaviour

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetThreadContext

Checks whether UAC is enabled

NanoCore

Malware Config

C2 Extraction:

185.244.29.128:9995

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/