MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5ccc5ce755b5273935290c41751582654c3f4783c07df8cf91dd783cd3afc1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	f5ccc5ce755b5273935290c41751582654c3f4783c07df8cf91dd783cd3afc1b
SHA3-384 hash:	7e56a1f1c36928afad3e47297e9c0e18bebdb6ee911847c55e8457d9b7e54e2073b2f31139c493e53430fd0e29bb7b54
SHA1 hash:	dcd2d79d9409e38956aa0cef4747938a8d645e17
MD5 hash:	6846c9d04a338a95f1f4182dcf16fc5a
humanhash:	eleven-pasta-kitten-nuts
File name:	Invoice_Confirmation.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	520'704 bytes
First seen:	2020-07-03 06:19:44 UTC
Last seen:	2020-07-03 06:51:48 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	6144:qfPHHAUPU5R5ko+In3GxEhWyQVP6oY34GZ0ta5diAstvLGtELbMUTKZ:qXAUC5+In3+HyQV5OJ9SityjK
Threatray	1'183 similar samples on MalwareBazaar
TLSH	79B47D423388C8EAE55328FA987FC93015787D8E9521D70E3743BA1FA4E3352245B79E
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: mail49197.hm1315.locaweb.com.br
Sending IP: 201.76.49.197
From: Kelvin Grant <contato@goema.com.br>
Reply-To: contato@goema.com.br
Subject: attach reference receipt.
Attachment: Invoice_Confirmation.img (contains "Invoice_Confirmation.exe")

NanoCore RAT C2:
vicnew.duckdns.org:9090 (185.165.153.32)

Pointing to nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacy-matters.co'

inetnum: 185.165.153.0 - 185.165.153.255
netname: PRIVACY_MATTERS
remarks: This prefix belongs to a VPN service provider.
remarks: For us the privacy of our customers matters, which means we store no logs
remarks: related to any IP addresses.
remarks: Spamhaus, please note that blacklisting the clean prefixes of our hosting
remarks: partners and upstream providers is an act of coercion and will no longer
remarks: be tolerated.
remarks: Coercion is punishable by a custodial sentence or by a monetary penalty.
remarks: If you continue such practice we will not only take legal actions against
remarks: your organization, but also make such blackmailing attempts public in the
remarks: media.
country: AT
admin-c: PMVS3-RIPE
tech-c: PMVS3-RIPE
org: ORG-PMVS1-RIPE
status: ASSIGNED PA
mnt-by: PM-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2019-10-18T13:31:16Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/18590/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.362.14092.30655.UNOFFICIAL

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/f5ccc5ce755b5273935290c41751582654c3f4783c07df8cf91dd783cd3afc1b/

Threat name:

ByteCode-MSIL.Ransomware.TeslaCrypt

Status:

Malicious

First seen:

2020-07-03 06:21:06 UTC

AV detection:

20 of 29 (68.97%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6xgmlttvlnjhhe2ssdcboukyezkmh5dyhqd57dhzdxlyhtj27qnq._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

65603c7a88beb93205d2012ca8d63dba310fc0f7f91fc81300734ee3b2eb3f10

NanoCore

75830575168e1d024a8d0c86764cb9b88eea3c79f0c4a24fb39d4e94fd2c42d7

NanoCore

819b7cdae5437e09dddc2263080df829d2e8ba725f4364bfddf0cd10eb848692

NanoCore

86622b1479706d348299e938ab1889c02f9c33aa1c572902e43367edfbbe526c

NanoCore

a37f501c2d65d191828fe20bf148436de23201f6fe852d59dfa67aaa5fc206e8

NanoCore

cb5eb4758a41046a2f3fc084731d756aedf8ea212dc08c9bb2e6cd7f5eff6cae

NanoCore

d0a9cde7ebed2daf4306e0e76a341e6c4293bf9904ed464f5bfcb462dc0999d0

NanoCore

e33ef485c574d639eae34cd252d97aa78c17718190c98a92f7b6dc5a5fc0cd69

NanoCore

f86a114e73dd0f15bc888e3db1477aa4c92d333bb236c4d3d1f49e72858bb80d

NanoCore

+ 1'173 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

evasion trojan keylogger stealer spyware family:nanocore

Link:

https://tria.ge/reports/200703-8294p387vs/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Drops startup file

NanoCore

Malware Config

C2 Extraction:

vicnew.duckdns.org:9090

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/