MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fee5158177e7960671d9a1126ce5d7e0bf56501f914ceed43c87cfa392c72768. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fee5158177e7960671d9a1126ce5d7e0bf56501f914ceed43c87cfa392c72768
SHA3-384 hash: 39038fc128371f4541c7435f21757e754ba6584794c9d8b5eaaaf53bf4b67deb12928dbefb93920cbb41390ac749a54f
SHA1 hash: ea6aae79994c80d0c981548bf80cfa2e42e88297
MD5 hash: c6d085ae919d8e12a79d1d55b9839df4
humanhash: mobile-orange-failed-sodium
File name:U2MS7C5X4CPAYMENTINV0ICE.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'048'576 bytes
First seen:2022-01-19 15:52:28 UTC
Last seen:2022-01-19 18:07:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:03yWHaQ+aKyTKm0IvRxKXIVVlQBRuMzwHJeJ7zzwHJe:kVQ4n0IvQeVlQBRuCwpeJDwpe
Threatray 4'990 similar samples on MalwareBazaar
TLSH T1B125B35C7B426A73EE8ED5704D030A16BBE70F132A84A9D71FAF29CB974F0661D45C88
File icon (PE):PE icon
dhash icon 62e68c18148ca0e0 (10 x CoinMiner, 7 x AgentTesla, 4 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore C2:
194.5.98.28:4100

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.5.98.28:4100 https://threatfox.abuse.ch/ioc/295279/

Intelligence

File Origin
# of uploads :
2
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/220699/
Detection(s):
SecuriteInfo.com.Trojan.Heur.DNP.an3@am1MN5fG.10853.776.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Launching a process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm cmd.exe obfuscated overlay packed
Link:
https://www.filescan.io/uploads/61e833e9f81da814af8fc0f1/reports/5bc1d177-91ca-4c82-953d-cedfa852646f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/adabecf1-5082-45ad-8217-4ed71ffff5cd
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/923600
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
Binary or sample is protected by dotNetProtector
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: NanoCore
Sigma detected: Suspicius Add Task From User AppData Temp
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 556080 Sample: U2MS7C5X4CPAYMENTINV0ICE.exe Startdate: 19/01/2022 Architecture: WINDOWS Score: 100 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 13 other signatures 2->62 7 U2MS7C5X4CPAYMENTINV0ICE.exe 3 2->7         started        11 axsd.exe 2 2->11         started        process3 file4 46 C:\Users\...\U2MS7C5X4CPAYMENTINV0ICE.exe.log, ASCII 7->46 dropped 64 Writes to foreign memory regions 7->64 66 Injects a PE file into a foreign processes 7->66 13 RegAsm.exe 9 7->13         started        18 cmd.exe 3 7->18         started        20 cmd.exe 2 7->20         started        22 cmd.exe 1 7->22         started        68 Multi AV Scanner detection for dropped file 11->68 70 Machine Learning detection for dropped file 11->70 24 cmd.exe 1 11->24         started        26 cmd.exe 2 11->26         started        28 RegAsm.exe 2 11->28         started        30 cmd.exe 11->30         started        signatures5 process6 dnsIp7 54 childhome4100.duckdns.org 194.5.98.28, 4100, 49746, 49747 DANILENKODE Netherlands 13->54 48 C:\Users\user\AppData\Roaming\...\run.dat, data 13->48 dropped 72 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->72 50 C:\Users\user\AppData\Local\Temp\...\axsd.exe, PE32 18->50 dropped 52 C:\Users\user\...\axsd.exe:Zone.Identifier, ASCII 18->52 dropped 32 conhost.exe 18->32         started        74 Uses schtasks.exe or at.exe to add and modify task schedules 20->74 34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 schtasks.exe 1 22->38         started        40 conhost.exe 24->40         started        42 schtasks.exe 1 24->42         started        44 conhost.exe 26->44         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fee5158177e7960671d9a1126ce5d7e0bf56501f914ceed43c87cfa392c72768/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2022-01-19 15:53:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
42
AV detection:
19 of 43 (44.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=73srlalx46lam4ozuejgzzox4c7vmua7sfgo5vb4q7h2hewhe5ua._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
0b1396805e736275f16550f3ecc5361cfcccc468094b4ea910ded8eaf430a5b3
NanoCore
30e1ba61a63a27b668eee09f960a83d944e878c33b46f85ea86bacdf1427f4dd
NanoCore
3b423344c5fff0aee78a4802681bac29d85c0b5edc1761caf455dc6bf0fce59a
NanoCore
8bf0518cd0c607aa51073dfe422f6af43ab8b43523bd0c182cc6172c9ecb9072
NanoCore
8de953938b8fb2d222892012da5758cefe50de064f61416c2bc2c6e6f019352c
NanoCore
acc1c22f2003ccec8114d0cf6f022836c8e00ab0e895a6a59f6a11cdec2db3b4
NanoCore
d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf
NanoCore
e3a4b7f4c06b234b71769adaa1df2b4e00b7c1953ffcc9216a89b2c8a673de47
NanoCore
+ 4'980 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220119-tbmfsabcf2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Executes dropped EXE
NanoCore
Malware Config
C2 Extraction:
childhome4100.duckdns.org:4100
Unpacked files
SH256 hash:
fee5158177e7960671d9a1126ce5d7e0bf56501f914ceed43c87cfa392c72768
MD5 hash:
c6d085ae919d8e12a79d1d55b9839df4
SHA1 hash:
ea6aae79994c80d0c981548bf80cfa2e42e88297
Link:
https://www.unpac.me/results/86cf2cc5-1a30-43b1-8b1c-9df750e8e66e/
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/fee5158177e7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fee5158177e7960671d9a1126ce5d7e0bf56501f914ceed43c87cfa392c72768

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Dotfuscator
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Dotfuscator
Rule name:INDICATOR_EXE_Packed_dotNetProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with dotNetProtector
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/220699/

Comments