MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb25c8a64c09f9c4e8c586b94d5cda1dc69be203b786ea297f9293d7bd7b8b30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 15


Intelligence 15 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb25c8a64c09f9c4e8c586b94d5cda1dc69be203b786ea297f9293d7bd7b8b30
SHA3-384 hash: 374fe3872c36fc58c1f6d12ddb047110eb9dea87c6de189ceaa28c3df33e8550e041f7642eed186b0f148115f790325e
SHA1 hash: 07534d5012526f6bdec5314a4d140de5d94672ea
MD5 hash: db555a9de355c70681e2e5f9ed38a335
humanhash: six-shade-foxtrot-steak
File name:db555a9de355c70681e2e5f9ed38a335.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'115'860 bytes
First seen:2023-05-30 04:20:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (389 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 24576:QTbBv5rUvUaHOI/dnZ5Tm0mGbQKomFGa6mFWqSRA4Q1Kpg6:CBUw85QX7A4Q1Wg6
Threatray 1'242 similar samples on MalwareBazaar
TLSH T1AF351202BED184B2C5621D326A76BB21A93DBD301F758DCF63D00A2DEE715C1D635BA2
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon fe7e7a7a72767060 (1 x NanoCore)
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore C2:
212.193.30.230:61715

Intelligence

File Origin
# of uploads :
1
# of downloads :
382
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
nanocore
Create hunting rule
ID:
1
File name:
db555a9de355c70681e2e5f9ed38a335.exe
Verdict:
Malicious activity
Analysis date:
2023-05-30 04:23:10 UTC
Tags:
nanocore rat
Link:
https://app.any.run/tasks/31e2a0d3-99fe-4b8e-a15e-bbe7a9a1d893

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/393258/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Launching a process
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Launching a service
Sending a UDP request
Creating a file
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/88611/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm autoit cmd.exe evasive greyware keylogger lolbin nanocore overlay packed setupapi.dll shdocvw.dll shell32.dll wscript wscript.exe
Link:
https://www.filescan.io/uploads/647579af0397a116f13d0111/reports/2f6d4a39-958e-44ff-8452-e66974ef02e7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/fb25c8a64c09f9c4e8c586b94d5cda1dc69be203b786ea297f9293d7bd7b8b30
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3eed1822-44d7-4533-81b3-581bf5aa14e6
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1244852
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to modify clipboard data
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Starts an encoded Visual Basic Script (VBE)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses ipconfig to lookup or modify the Windows network settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 877862 Sample: P05jmXYKpr.exe Startdate: 30/05/2023 Architecture: WINDOWS Score: 100 87 Snort IDS alert for network traffic 2->87 89 Multi AV Scanner detection for domain / URL 2->89 91 Found malware configuration 2->91 93 12 other signatures 2->93 11 P05jmXYKpr.exe 29 2->11         started        15 RegSvcs.exe 2 2->15         started        17 dhcpmon.exe 2 2->17         started        process3 file4 61 C:\Users\user\AppData\Local\...\boaliim.dat, PE32 11->61 dropped 97 Starts an encoded Visual Basic Script (VBE) 11->97 19 wscript.exe 1 11->19         started        21 conhost.exe 15->21         started        23 conhost.exe 17->23         started        signatures5 process6 process7 25 cmd.exe 1 19->25         started        27 cmd.exe 1 19->27         started        30 cmd.exe 1 19->30         started        signatures8 32 boaliim.dat 2 4 25->32         started        36 conhost.exe 25->36         started        95 Uses ipconfig to lookup or modify the Windows network settings 27->95 38 conhost.exe 27->38         started        40 ipconfig.exe 1 27->40         started        42 conhost.exe 30->42         started        44 ipconfig.exe 1 30->44         started        process9 file10 59 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 32->59 dropped 79 Multi AV Scanner detection for dropped file 32->79 81 Writes to foreign memory regions 32->81 83 Allocates memory in foreign processes 32->83 85 2 other signatures 32->85 46 RegSvcs.exe 1 14 32->46         started        signatures11 process12 dnsIp13 69 december2n.duckdns.org 192.169.69.26, 49699, 49700, 49701 WOWUS United States 46->69 71 december2nd.ddns.net 212.193.30.230, 49702, 49703, 49704 SPD-NETTR Russian Federation 46->71 63 C:\Users\user\AppData\Roaming\...\run.dat, data 46->63 dropped 65 C:\Users\user\AppData\Local\...\tmpE45C.tmp, XML 46->65 dropped 67 C:\Program Files (x86)\...\dhcpmon.exe, PE32 46->67 dropped 73 Protects its processes via BreakOnTermination flag 46->73 75 Uses schtasks.exe or at.exe to add and modify task schedules 46->75 77 Hides that the sample has been downloaded from the Internet (zone.identifier) 46->77 51 schtasks.exe 1 46->51         started        53 schtasks.exe 1 46->53         started        file14 signatures15 process16 process17 55 conhost.exe 51->55         started        57 conhost.exe 53->57         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb25c8a64c09f9c4e8c586b94d5cda1dc69be203b786ea297f9293d7bd7b8b30/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-05-27 06:23:00 UTC
File Type:
PE (Exe)
Extracted files:
67
AV detection:
26 of 37 (70.27%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ms4rjsmbh44j2gfq24u2xg2dxdjxyqdw6doukl7skj5ppl3rmya._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
136f87c6d9a1b61c87ba550c7f550e54d66a1b51dab1c803c43705f178ed9e55
NanoCore
163db4da78af3020f61a1d98aa27be9377038f4d254bfe84f19ce9c324c849fe
NanoCore
4505a80b468e6816046c95f93fa332409314ec77d790aa07ed68d4b481feed7b
NanoCore
51ba2b6912305fd63c041dccff36db067314cab3f93227aaf21990801efa0b25
NanoCore
91c723477dc628808035ee98667284a3efc0c003846f15962a3623d363f7bc08
NanoCore
c383e13ebb1a0c00a23780d02a2198cb2530b826c3b621eed6bbc6cc38c30084
NanoCore
ee0fac5b1ab0a1e4c8efadea7919f8f1105d0928ca3a7c359a65af0246e06cf1
NanoCore
+ 1'232 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230530-eymyhafe5v/
Behaviour
Creates scheduled task(s)
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
NanoCore
Malware Config
C2 Extraction:
december2n.duckdns.org:61715
december2nd.ddns.net:61715
Unpacked files
SH256 hash:
fb25c8a64c09f9c4e8c586b94d5cda1dc69be203b786ea297f9293d7bd7b8b30
MD5 hash:
db555a9de355c70681e2e5f9ed38a335
SHA1 hash:
07534d5012526f6bdec5314a4d140de5d94672ea
Link:
https://www.unpac.me/results/fe4d1a40-2a6e-47a2-a2f2-a03a95f8b991/
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fb25c8a64c09/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb25c8a64c09f9c4e8c586b94d5cda1dc69be203b786ea297f9293d7bd7b8b30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:malware_Nanocore_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:MALWARE_Win_NanoCore
Create hunting rule
Author:ditekSHen
Description:Detects NanoCore
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Feb18_1_RID2DF1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:Nanocore_RAT_Gen_2_RID2D96
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Nanocore_d8c4e3c5
Create hunting rule
Author:Elastic Security
Rule name:win_nanocore_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/393258/

Comments