MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4bf592fde78af7ed0b06166ac8265d7b65a2457b9a61f12c2e3a4fad641ac19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4bf592fde78af7ed0b06166ac8265d7b65a2457b9a61f12c2e3a4fad641ac19
SHA3-384 hash: b50ebe1ba24440734a93a458a5bc6f3734296f606a61b8b6c640ec0c229fa9d49e9b1f20f8b57ad61e380d194b51dc8d
SHA1 hash: 76cedb700e7d809707810e25fe8ce5dd04d54d43
MD5 hash: a64b706c463409a03bad394338e561ad
humanhash: florida-xray-mississippi-high
File name:Order.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:568'320 bytes
First seen:2020-06-01 19:47:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:SAIH3CvO/oFcan0EH3NooIDBQiwu6fHaVv3Wnrqlmlsq/M1cc4hg4qhGpwICk:AHyvOA8GoBBQiwuzv3WmlB
Threatray 1'097 similar samples on MalwareBazaar
TLSH 6EC46ADC7620B1EFC85BD472DAA82C64FA5078BB831B4213902715ADEE4D897CF645F2
Reporter abuse_ch
Tags:exe NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: moto.com
Sending IP: 83.166.241.19
From: Steve Park <madie@brandonnellis.com>
Subject: Re: We are interested in your products
Attachment: Order.arj (contains "Order.exe")

NanoCore RAT C2:
185.140.53.3:8976

Hosted on nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 16:57:58 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6s7vsl66pcxx5ufqmftkzatf263fujcxxgtb6ewc4ospvvsbvqmq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
10539edea332bd2b0a1c603801a445c2008a8574411803e66b7b79c4b0b8585e
NanoCore
3465a87f7c026e390a862f5d4b638745f80fa24a5ef94998e2f5c1818dd0bc15
NanoCore
3e31c8b099b67a798b809a8c4d37462d822868abc58e1b8e3ce88fb521723b92
NanoCore
640477c11295f4211d11bc6adaf108da81e315fd31dfbb02ea2d18e3008b55e5
NanoCore
67fef2f83af3da398f5e144ccc65e18d7d30b57f53d94658cd62fe53d5e3d81b
NanoCore
77ad1cceb8cd1ce751036f49dd3911db0586e12c23954b3df7b4319b4eb410a4
NanoCore
8aadc9eae1964c2fa5d3ba8f6816a239db391f4cfb38785367eee5f2923b5f9b
NanoCore
af9ff2feb141ada2c8ca807fb12326dcb0d377d372d13955c33ca6aef378b387
NanoCore
b40368bf626f0fed0e151c60aae6f5cf0637ea5c7e183f1058b0527a82b65d06
NanoCore
f48765a1f0d8935608acea2058dbe36d76358a835320110fa9d6b6ff15ef0882
NanoCore
+ 1'087 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-zcahzw1tce/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
NanoCore
Malware Config
C2 Extraction:
185.140.53.3:8976
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

arj c87e221195707c0d846ca8e589544a40c959b46f5273d4d969361f7a6d289b8d

NanoCore

Executable exe f4bf592fde78af7ed0b06166ac8265d7b65a2457b9a61f12c2e3a4fad641ac19

(this sample)

  
Dropped by
MD5 08a84e117a4b1d0298cb952f96210d78
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 c87e221195707c0d846ca8e589544a40c959b46f5273d4d969361f7a6d289b8d

Comments