MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 18


Intelligence 18 IOCs 1 YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
SHA3-384 hash: cc64549993cd69f40991642aa2c2591d00ff769e6a39515249a8b08b6d2bc4d12df8340d9a8c8518f5fae24db69f0b30
SHA1 hash: 8be94f9b04e2d97e74204ab777e8f3d4595c27af
MD5 hash: 95b6a0d6bdeed35911ad944f0d3b6dab
humanhash: pasta-batman-red-leopard
File name:Shipping Documents.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:685'056 bytes
First seen:2025-05-01 07:07:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:/MocjzKHoaRmCEbErBfqCyzbVqv4gYLLAviu/uknn5ZHWfc1+Uzqil:/MT+HFRbqCMaxYLgiu/uy5A01hzqi
Threatray 4'066 similar samples on MalwareBazaar
TLSH T1C4E4CEE13F76772ADE646A35E66CEDB582F10D287045BAE219DC7B47329C2419E0CF02
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore C2:
172.245.244.78:4184

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.245.244.78:4184 https://threatfox.abuse.ch/ioc/1493221/

Intelligence

File Origin
# of uploads :
1
# of downloads :
353
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
nanocore
Create hunting rule
ID:
1
File name:
Shipping Documents.exe
Verdict:
Malicious activity
Analysis date:
2025-05-01 08:51:34 UTC
Tags:
nanocore
Link:
https://app.any.run/tasks/f2c3c8be-f43e-4410-96ff-5505ed21330f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5435/
Detection(s):
SecuriteInfo.com.BackDoor.AgentTeslaNET.28-2.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68132140c8b2e86d0ac5b364
Tags:
nanocore virus shell msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Creating a file in the %AppData% subdirectories
Connection attempt
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/68131ddb46fe05453cabb4df/reports/21cd3b0e-c7b6-4350-8273-1a763b1faef7/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
Malware family:
NanoCoreRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2be772d5-7083-4c52-b5ea-9b9eccf6f829
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1678800
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious powershell command line found
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2025-04-22 07:29:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=733d4noxskyvu3dudclnykmy5hjvt2ux6ppnnng5jd3u55eoxsja._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
nanocorerat
Create hunting rule
Similar samples:
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00
NanoCore
307e36dbfa77c7fe9d4ed5cb61d36a4fada75e7a2db52db3e1df80d222f768d0
NanoCore
4e31d493a6e64c76ff10026b147f95c6f2982860609803d88c8738a26fa3309f
NanoCore
9d381423ee9f27108e8df36d255f1cfa33e6873ab0d7827d72b47d548293024b
NanoCore
b54e60c9821848c2ed3555992e7a413738176ceee30700fb264b0cda23b6c541
NanoCore
cc0f668960e58ed14928b9ecc674c8dce304d6ff558618fc0d7b7eb7f2287203
NanoCore
cfaae9c47bf878627929342f50da998d65f9e7912c5add3c511e6797d4c5f755
NanoCore
ee58fa913b4f5d0527453664b762b848404c19c23369ab6c4c893d55adbdde4b
NanoCore
+ 4'056 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore defense_evasion discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/250501-hybr1sgm8v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Checks computer location settings
Command and Scripting Interpreter: PowerShell
NanoCore
Nanocore family
Malware Config
C2 Extraction:
172.245.244.78:4184
Verdict:
Malicious
Tags:
nanocore
YARA:
n/a
Link:
https://app.threat.zone/submission/75b47f3b-d840-4e74-aa70-5b419a600150
Unpacked files
SH256 hash:
fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
MD5 hash:
95b6a0d6bdeed35911ad944f0d3b6dab
SHA1 hash:
8be94f9b04e2d97e74204ab777e8f3d4595c27af
Link:
https://www.unpac.me/results/566d03c7-54c8-482e-b9b7-777864ca1329/
SH256 hash:
ae1287831e6c4c0feb35d4b3eb5b30bf9947a6b73bc15b97a44c35cff791ea9d
MD5 hash:
5cad655e43ea114549f30da2821aeb61
SHA1 hash:
2edca57d756c61e40e8bc755de282d8783daca22
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/566d03c7-54c8-482e-b9b7-777864ca1329/
Parent samples :
16710103bbae3fbc560ef36459df90649918b2b33ec96d0a277d10ea31f81fcf
682d77e301efe76c076423cfa323ace12a4adb04fa0b8886b154684f89e983cb
1ff831f648c1e5b70a5537bb6180d5a1912e5a33b79179a279b5029da86696ab
c31f10c979afe3c22fd1cc48b720cd880e0c1a4b2ea1e7af2057191058f410a8
4f8641371c70db217c573c922367c68f799e0e31a62e99404a59015b47baa67a
d1f2a9b4ae7ed0c866dd923d5d7cfab3a03af9e16f330a28cc66bddb97a0757d
dfae325223b17a4c65ea52dd31263dca38c50b48e814696ce39e871fffce8cd5
2fdc7b9f1318dd8a1fc040bf65c4d20f5f1df79595a59289fa9f4652151a6dd8
cec28fd0f6fe4e4cd3f7a2d28cee64322d7b4ef6a46def443d5c75d8969e2317
506d458de1be8c32adfa1a05c28cefe854a30e6bc2d1223bf27e4e36a7ab97c6
96f0384cc3243e0bf37abb7504f11b1bdecabed45a961cef490dd91e4040c19f
56b23a0a370244334ac5ddf297014a5af92baf07ffbc00fbdc43d29e1637e553
3684e368ddf1222829870f373194218a0e7032f6d5429d6ae80fb04638ae8211
d237d2765cf6f376713e70781f15439569af843ffef61b89fc4bcc11c4aa89b9
00d5c9aeb99d4e1a78c18bf375d4a47528e89951bbc11dda251d0c7b17c5d3ba
e4997c748608a44552daf6262f503b22f5d77e20bb4b411c6342bcf6c1690ff1
8ba17fe5add6400885d78698311fdc2586cd6ceba5578eb285ac64b77b065e16
f0695b975e0e13218720fb19aeead0d365d7dc99ac0d32d8b0227a3224cf56f5
df605c519f38938acca993e1a831fe032c1e156576852b491d3279201e62fd3f
ffe5dca9d94344ba35262a0eeccb6944b96375c0328b958796f8613149f147a4
be382be770efca98969b48895a2e7c41595a77cd79154a730db6b5ea9f0d2270
3ca964d47a615f318ba0fe2b31dd5301cfacf51c9fd20015d2a898901b3733aa
34de6cabde0575f417b9491911199dba9380977f10a1b7bb0a335a61c7a9f372
1f33285ecfd9edecf724b76378c34b1580179e5eb8a4427da3ceea6a44b3a792
728d076928cc7cd4a79baa23419ae597aafafbce6bcf3d409bfc53eaaa684952
b9bcdc03e3c7fa904284298f4cfdabe0770ea82907fc73a462632a75ae8efc80
fa1e69cb8993771043bd3086c917259601f912263edb53e2edcc29e99cdf54e3
a0908f2e12db17eeb19e8fed82af3f21c4026ff9c75157e42233136512f58c63
b4c6a4b1994014363f786838748a4d0e01832cda7d85c9c0ea73529c16ec9e26
a86ed888e10ea024b27aefbb9eada25bf7bf5eaa21fec5eb7a82d9123bbaa6cf
7bd235f539219215d5df194e6d2ba885366d939e4b692f97a194463ecad34d4b
240c09f1a97bb6068fbe9c61b6026c0997dc5f2a06ae80e0c15ec691f40f30ee
eaab91d22d868257b7e6d93e17b10336967a9bebd39573145f5830a4b7d0a1dc
33c9ffdeb5e94c9bdce7dc3d0ded74f15e49eeedf44a64ce454cf065bbdbd1a0
577618a8427cc363b465ddd0d06924799d820b32e2f4e42e67a852e072198957
a8f3269aa0125bd0093aac23495f4dc4784660bda3a4ee9bf871ab79d75e65a8
87ab552cd2d84cd5fbb0c4a5bdacf9886687d314fe67b2c47fff9caff4ce31d7
5f25c8dcfee56dc11e03d1001f7c46e5adc9103651771cf82875dbd3c95c6775
502954caee03e25d62dda3bf7ee722629dff96e20cc3be8478a669ba1a62983c
c37baca5c488614ed44b90ade56d534975201dfa94327ed216b3c87e3ff8cc7a
c21ea61a25ec98591e132294aa244adeb9467d4c7abc0c6df772dc1d662f4b84
649bef3ff15efe5ff2efaacd71117cf6fcf02d33ecee43b049ca13dd0b9b63a2
5271c1a2883919c00e117de2efd6832ebbac3faf78dd2bf79641a550dd244398
b4bcb99e73f47c4a4f50ea83580f6d6722b685fac73f9dc11777ceedb8d97f8b
c119debcb955f7bf495359707990716136e4fe5ca31b6f8ee27f4895afaa7404
99eb21753db52508e65ced48f7f5dae3fb00a288e22dd1d54df7bca78f394bb7
8291fd2e2188911c99865faac1cf303e8587f69239e7dcbb5b9444bbe21c9cde
009b9ffd2d908195481e9234ba0290ccbcff6457731bcf0c5e6a7d770a4077c8
94b6467cd5aea441330626de9ea2d6be92c349fbd4932766f644e461bacbda24
6f9b050c34122c2175ed83fbe4bd053133295c84610a991bd6a16940aa322ea5
61d063ef343fd9f0a449149d94cbe2d515ea50bcd008c56dc66af8a91353f4e4
1baa01491b76eb9d1e39b233dd2966cf7f1babc5cf6cab48ca6e40b80d87f0b4
37f0e1197e435fce2311791ff38dff3c9b1332e4485c1648bc654990e7a429d9
79d7a511c69ffd0c34847d5e459c9a8585e3625d66b4666a24212fb6740ca36f
6f4997b2a236ae5d05902e64165d6ab9a95b5055903956a24ee92e8eda908d87
6c3c65ec59e1fe33db808e362b9a58335bfa9d375c4b9e717f6c95dcba725f82
5c59105006959233e9ec2e049c3b7e9b4df0aabd262e37fa8ccf0154557b4bee
de318bd60337fc20d8b67fd07db9235adec03d3f6af004e30a4dbedd9c63bc2d
85eb3041d52eb735c82cd60b3a9fb25d404de4abdf04fa920c81ba400032e881
e062f61985db319dc9f4a230770e7cab783cecec8c61994aeef2d75d86942a91
07861f62cec0fd9054939fd5a062da7ad01d781a72057dbac6859c068db001d5
8fb11fa0364c17c99805db4165906bf4592c745ec78f665acb830755b2b18567
92d76de45d33072ac68cbb8bec478169366519a4ee7c9d295fed796886adde26
bb14569504a137a5aa8d5923abbfb57659727db4d5903da93e577cf7cb9fe319
15b1dd61220782f0fd48d6ca10e0a556e036f2ce0450e443ee33a57fb6dd4ba9
ade03b33ad1a47b43d99a5eb7f469d127f98df657167c31700fd3c5cc76c522d
84d43d54b0cebab94fe2feaf56e7c5f223df6f7bc1e71afc12760989c21761f6
922a35308a57f55fecc984dd5f8008360639a389b8bf37e46c0a14bcc8d7c8fd
8f19d493ab01745e743d2781b610c2bc92a959711bc6fdad3d3937dd0d334cb6
fe3589253a8fd6aa4adba398ef62b6066dc076bf610025d8b05def15ba3351f9
7080b6bd8792eaf9753134b20ce4ef1e7bb089bb62c109803f2c12c674194675
95ab39eaf0c052142e609568672d0c472c87cefb1b34e974ff92935bdab75a09
6b4458f800fe38459a4246d7e08fe939daa453ddf95cbd6821ca2e32adc121e4
e3ecb9d4d5f679d7928ce68194ab19fb38876f6c5e72cc7d3d58fb708da26a3f
0e2e5e933088b8e54067815a50b38d0dbb7430ec61b1c3ae6e3c9196f660666c
373abfde84867e8ce9ee0d8b4619f746cbb749540dcaba53fa0a544033db7631
200106384688b9efb05757f00720f400cfa27135b7ec8f3b320f6466fc2bbbed
4ac0bfe8161d9f1cd6e355f8b7d0793b12bf610c9114d6bef8bb9c22ec1497e7
f99cf9f643c2e4d0517b48a35721b6b6df1feb97895c476650f3364d55fbc77c
f987997a15f2ffcc9430d67e32f54171fe58e4c9f6865146b83cbb79279a0b25
d0bad580ed3fba0f80fe09ba1778ae49fbe29a0ea09548a70c49330e24722665
2678402a1e4a4512e44561494f1c7ae7e30b86e5621fe722f183a6d82c17cb9f
9fb47b33659773bb9ac4b4c224f9dfda0152f8a062a4d73f2e22c6db694e3473
b4f779c06421b878976598d11fe86b9cf3b92a04d93c9ce11b57772876ccc2ba
4cf6dcc350b1f1f3dc9aa8e72601e9c723a878709773dac955c408d280f7a729
774051024bba00aa22363a355ec0b76518464d82eece577d98839966dc6cae19
10e7df181627a2f66999dc4bf87095501b2e69833efd4ea6262e27f0b5b4b272
b7948a338d06c448aa9a7377e527688ea5438f82ce0bee447f6ab57932b30ae5
17a6a498aa82d15f97cabc8a7a0277b2334e2a0edf5d315d87733c6339194c72
861b9d85f642873dd0f034f6f946e3791c4cf94c6687527320d26a2f217fa04c
afcb27b266ed8d8c78cdea743c59abd521bddf2eb56d3930f6b1c4ad115627bb
14bec9321ebe46e28e8f38d4dc2d3ca9beac7e683cfb316a208fea291629e77e
320b021b187d07f6f0b7b54483430e85251f4cbfa9fe32ab63cd8201ed9a0678
0f9eaa5bd9e8297ecd792d9b31345262be954035ee6ec3aa323374297f1f125f
e2b1474db72b91f6e9f35fefb2c9608a5371d21e519e392344d5246b7ec062fd
91627eee26e26e9b35346679b12d9ef8a08d74be4a8b58d312d9b36960cec7f6
5e47d534bc69265885b633e57144923a33dccc9e6f19aae9b1906057fada4ef8
be83e0b3f35f8c1c74fc219587b3fb7760ed49a611c5d060dfff4e5853df6c0c
0e38d9391f83ece1c83fa94f5190c4a7a446feec38f305707fbcffd56f881892
b9e560839e19d9fc3cb727c4dd29a81566162a924b9a8ae5f55523284a243cc7
b8c9775f98ecf9d5fc1c9710289f2ec6a843e9a374a34cf29c53e21471d4762b
56ad5414ed2c3a9779bae69c39ecfd87b8c5d655af701b147f02eab671c4b6ec
31094d6d367c92b595d8d48818b998fa9d3c6114e25b48256de8621a2b5f2baf
03ddcfc0bd5eeddecae7ea59eb8bb9bf08a55a1f03784a3e09b99df597149bf2
6c4d270681da5377dc375d3d4d026eddef87918f6613990f0779884b794cf415
34bab60d1a03e397c209f4455d1dc0dc6cd2c1a5348da1e0e99f16e069723e22
4f111dd6b9cea83f8647ff3293c8df2962b052faacbee349867bed985a4703b9
e5f629d657b8baf55380a2310b6355422e8c3092fea3ae757b3c4efe3c6e8bbd
49d2dfe9ec5ba7a99753d71a6c091c185aa7adb5f4325b08219514ba1e6cf456
41bb59ca5ad601c85e0ca7ca6233415f010f4388a7bcb6180d922875a258addc
d6ff37cf17f73dc09e1bb459d7ebec5bfe3ca0acac5924ebeb15c01e1d5985eb
bc407aec3c1515d5cf405c36da5d2336361e57dc07afba016a5a6379b56892fa
8c87d9eb60632c48c1c1ebf86eaeacbc397e4d33a72c82bd9c4d8809e5096102
35f56e6019406ee4247dfaf7a96e210eee795c8b05dc3c3666a2f644a8d4beab
e2c38e07a5c77d5cbd006efb20da82c97a51ff450e2281dbc11d13541ff04041
ea686a707c6f103860a3d9fde1357211e15b9aa8d089469a04d2aa1db788727a
33ebc1a99345339f295f40833f9a603c278d2d7fab7d14d4577a1273689440ed
f7716c15ec6f2fbbe55ea20de84f9b2b2c5c985f65aa7482a1aa7cf8bf1d06d6
cdf4628b66669c11801084659542a15705c73e5bc511bfc44bbcb8f2e53eb9bc
490df09cdaf2bc63fbc092022717eae73f7ebd54ae6c7d0db3f2a8823843d192
ab6443a215042b7eae0b57326750dcbde20b5b6991784124f29afb192c45f7c3
c16db060e8233abed92109f90b60c07a36acce85bdead063d887f89d2e2c1cc0
fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
faad2001e21503cfa4015511f761b5db63c6a1e581d140021359eb60184ff222
b7aadd054d5fb0c87d9b836a154694668291bcc1984a529cbf7f1dbdaab39e8a
8405f32eab91947b14c6411f949b265a1a2aaddcf82b1456f78698f3c8f50afa
5d9cf119c0e1d06c3625fe6b3f3c2801e2bf8bcb38106687ab961245971c2b91
df26441999f9925dd10b83aedf9103bb451949258b348ef1be5bc48755019c9e
64c1ac17daaadb7279a761edbfc3f8842478d61e6f2c9094e3859b4c42da02af
e1e626cc22627d69502270892cbcde3b6a6cf6e3326712b47c736cfa48dbfacc
72a10a903b9644206b86f80339c21cb454327f3afb6dfe63c939d354fd2af317
248bdde1eb2fff66b037200945c95b22c3c607aaf3c422b8523304a44c0e99f3
5ba47fc85b0a155eb88dee474eb149e2c31b75f2b5df7a24aad699dd81dae311
16197508cbf20d23fc248e0f533374f28162d5c227d02956e04f4031548c4cb9
6bdfc7f271661049f01ed2bcee714bea49f1e0ee604b3d4f4d0144cf39d5adaa
5ea761dba0e351f275464bae5ab9a2f5038b83cbbdd55113ab1ce30f1d182970
8c26b8e9d4ec4ed915142dba3a477f1f6490b25c7e72973501bb468ae8073d59
049cc2d1388dba66dfeb9fa5de703c293b681641a855d13a8cc1490b9d64d8ce
bb7306eaef188dabe0ad73b9346fe2704a50a0e5e5f9557f365daa6a97a09182
ee4202466c3df1bb44773ee382d9814bf0daac585b416e44ab0eeefc7a588aaa
eb830905829e3aac092afd0c536f9689998e8583a697128c101ea999e20b4aba
457f751b9e2331ce4586c67e13dc11de41be3eb7125197afb260394273d5acb6
d72e89cca70f53abd92985796b73f8913a342f6caabecd2d7dcc44de97b15638
6e9f1be5c0eba46abe922cd9b58dd67cf2073820ee6cbe2563e8b1fc63385855
6da71f21f5ce6bf44c9fcece5f8f685e705bc622e9b178658885cb5206d23078
715eff2e71cf1ace027a6b89656abc6aa127db6f6004f7dd10c32ea379e994b4
712a2a2da336e127eea276d37b664f1d82a0c5a94498a051021dafbc8d9bc591
b342eb87b5824c0c867e6a4fccc6c8f4c7a19d3ee8c75236be0adfad477285f4
19ec5eb482aac74018cd2b014d941a242792312c809d90be93288afb09330ac7
489fa1f06147a1d21adde71bd24108e0d80753baeb4b0ce2975d482410b87126
aa5bf0649b614a83ddb9ecd1454504d9d51126f426a9477e5a407b130cf80983
2e5d68fc3cd969cc3fb393afab405b214dd9b0fd7ae40eb4f49142397a00896e
26734c4f5080e7a15bb38d290173b208b7e872f923b4307cd201b2a756638880
e551928c5596eddc12863c8103bdc72fc53872c7ddb1988da7958e01ce21a1ab
572a8143626c3ba4a47ab7ddb26146c0de475ab3a0f405193305348cbc02603d
ec3eeb4b700498a998d4e5e80013d5d6e001bfb48232e9eef7bcca14b40d7a06
9d98e890098a67a4a0337c250088898831c3f39eb00792f4d036b3d439c7058e
781bbdbac8346f7e9d5b1530dfa2b8661d23b18a642bafb358e868c989760abc
0081fb53ed71968a848d5cd1f8a19baefdc97c1e82c111d844fdfec240fa4f52
27692e445216380a00c979161d2163a20f71513c179031a564e6274078d0fb03
5c29840575f0782ccd062371831a7eff2315436c0f1eece428e89fb6a1d6734c
c089cc6b6ad04e62f0c135710beef0013f1805df94d54aaa8502d39a265bbe61
7720932ac03ea7d847b5d3e035c4ab37b31bc4fce71fd6e0043f5149db231a8a
80b0836a4f3ddfcca0e16b9bca310eabbbad53ffbc2ab1a44913b590782da2d6
912421c5e67b1f2f502b615413c02a9e7c9d92d121baa694438ab3608b4b9f88
ff3f5b0f417e56c82fc9cb1340db97faff6149fa5b3c9df795fd91a40c509862
f00ac8907fec8e6dc31725e4080b6f4a6ec48d456ebd7e58009f24bc8e8eb3f2
110962df85578b3a3d46ff96d15966c0365f885f087ef21928e605fa7aa164cb
d922cfc7b45d17c9175b6de4653c9d7e62c8fbc390e6fa9ac294598a1e80c7d8
9569e962638eba6f9bf00474c616841bd7de003fcd5928472777f6c70837f73e
36982cd1c8dc130db45859545ee291128551060bf306217d6db4ae2894145291
5a7f0a0cd553ea494cf5b5b03ea5b81273218ce2b6132fad553ff91e24186811
8a950987e85870f393f8a7b623d826e32bd428c2f0d0f23112dff46066a7cbf2
35850ee5ec4788a4a2af929b805891f6bcf339869ec6c4407ad011ce7bcab4ac
02fe6d2d4a41946e2ecb73f29778cc3d94c30e53f824121af6732c08bb972419
66a1aa16b5484c0ebfcaf2100a347630697789b74fc9236ead6405477dbb7c50
1f891e16bae23d9493da67c92e7453b935aa95e815e6baa9a915c2897731246a
e309f8f28059b461a715d458825bc7e00b9e5606eea7337525e9a074dc9effe8
5e4675293aef9541e937220098ea561b15c44d2e22d8ac1fe3f4e0ee8b5aa09f
22bbef730c3e272f875e47ea0d4e8dc1add0396db3ceb6d86ee2d2e63c26f779
a74e18b6647b592a00068d8c7ac322a0bd617e0146ddd1864c44b8d2e8dacba4
fa64bcc79223407760ead3b9b78477e68fa18f3d65ae6c025fbde01f11247deb
efd056eb7d863e93fab3ecf6a1609d7c94ba5ae2e43b66204756dbe0a77d37fa
71ea55b141b72865cbd1c242256d71b7c5626ba9cd8533d3b5ee31f7db05599f
458fe84bbf2d7cbda5492d6517a134caee56ff16d888ed66b84722a9aebb76ca
8e44219248894eb248a11f54284a1c9b999ea0177209907f868ab8bc2783b9b7
174c55d7a28d85aad633a9d88c9e4d9946f28c277f3e793ed9c8a3ed98f869c1
553e57c67012138259009fbb10a4ed4dffaea95cbf154ef08fd02527ad97654b
6b1f5f74b6c2d96735412a65813be19b3b7d5303fc5bd43fd158df6adcb17c2a
86a32cb0fb642641f2b04987043472edaa31b283c437a64c9e0fb7a549ac10a5
3402c7e91b77a6afbff723873d40d063b04e494303e5b4443b29ca3d9bae5ce4
c580a68de9979980650d0ac1aea463cd970c1ec8604e6f419e9c057efbbfdf61
7cdb8fca5128be15e68fddef81ca58e6cef3e69f38dc885c6c413786c9b9f343
d63e95b7e4b8abec5bb4e3228f89903cdee6b0b8941686cb36d2ff6d50629359
ddaaf63a37f114e42a1548a57af2f9024e9f2e143401366b6351c1cd4d7963ca
46962429f9a17c760f25e988d2533164228f43484560298f6cbf030f26455d00
2af4f4e9c66b1153755eadf264c48ccb3fb55abe80ddc12c245f0109f18d6806
167439ff294d88a478d4c3d7045ff1d8506486dd97511daaeae95b9240f30961
d4b8c9f149cc269c8aca799dd247ee525d33f9d013750f817b4f858691ea5b99
b23029bbfaee8da6342356bdf09d9242634c9b92bad625d275da0135bb77f55c
e3db4470101ffc0e0bfff6fd7b9bc331c080702d0eee25733e793380ae3b8753
cff11adc2348327f3078333995c8101840ca782a1da1f6163a366b8a30a5b000
7cc0fdc66bfbc65d8d0035e1659a6bab04827aaa980d753d83020f1a9e3549cb
e95865bc13556c4a7666003b4c99406536cd9f6a17f6706104e707de3744bf1e
640e616659d0c6fbd1abe58a888cc144cc0026c625dad72f20ca0600fb194d50
0c0d773a601757285e5a3da3e8c45a6bcd4d66ac0363397954de172c8a2da704
60a4969ae924d6ef3a9604293917edafb3ec21ae801fa4251b37691c56295956
0cb2fc2e6a5de76b308f66079db3794ede4027b3c25653688654a9549f76dc86
d0259ffc2de3540cde857d4579389224de5c865df8bf299ae41dc9048a9cf546
eb2e2da880054567ab4736150565fcf7353ade196a8a500ef234f9a9094b9996
0ef5a44e6cfee0bc94b6aefce53c7fa98897a204fbbe59a58a416ccd8c2bbb14
710acf0f0b0da3df593a77e57a6def732030aa047b6c7b97ef116a04721f0a32
971cced569c6dea4431bdb0111654978961b84264346405254573c27215e0633
93297db87475693426faee1c64458b55d362823dfa14614c35b6650bc7369895
0606808ed17e9c16e0d11496b50484a2dcbd1e39c364659a55a946ef6b80c689
8aa9bc4b48e64fba1e1167eda865f7be096d9ee541721cf5ffa7cf9814f517b3
fca8a83c6fc8c413126b1c8466c1d4760fe4f5e354e7ca843c86cbb417cb20f6
ccfdbc2c2698e804cc3e9b200a6ad61d835b7b0e2aec1aa4156b025b7e9e7340
d6a89c41d73e93f00a90739678b1b977f81d6e0edde500e663a4400065d6c3b7
200028d1284bf0590155f241c66bf26c43661758386856a23b640f92da28833a
f960bca90abce5900c28180953467c72694b67d5e6d0218e5ac6edd454eab572
31a83a4477bc742ccccec7cd1ef6cf0b56fce9735efd420763eb1ac82ed81842
1a1670be4580948054412aaf8daf08bebce39d9a93ebb7f1656d15b569b9e707
a7485e9ab1ccbf4b337a2dc2b8b7fa95c63976d7c9886a43698ebbf1493d8c20
dc4bf2d8b23e74283b96c26dd98b0e8bbfd1611a51ec5ae47152527f11a226e0
c9d729c219c8909ffd7b6cb9de88e649c9e1df24e488d13752fe93bca352785f
0ffbd00f4410ebb5f3960c85150bda3cba26211c5736e5c9f57c39919323fd3f
773bcc376bd725ceb2bb00ede9541e1f267fe302cc40d8d519135bc0a830e214
da2b858b41f8cea09faeccec9284352b1403c1fe9c9f5320fda75c6ce41738a7
920d98ee99152622a6ab638d261e6fdf632c7f4c276706d7523bea6476ec561d
3c214c666d427c74d7fcd6434a03a5fbefbf5e1337daa5a33653da0320878b76
8ca0e41da8651f9fa36bc0a10df4445d609e778c05e9de397bc231f097459593
7c968428400818ec67d45cb4bf6b4bc83bfd37bfb7fa95658b05d333a98a54fc
fec56617a813954d1022f62e9b2755711fac4b5cdc6e1caa445aca1f279bd324
726071ea9188c81b141153a3dc8c2e356f3f789bb1d2c4672091cf3562158d3f
49e15a9ace08da2ee62f808c51dbbb91742fe4d3262fcce88e84fdd50d813abd
daa8984b462a0e7057a9641f0c54ec57f918ee3cca607ec1afcbbc1b66f7f73f
351443860dfecb08d26186c4314dfd38f6182e0bd3da85a9dc14dc0bf6d1e783
80597422cfed734ee2786723bf0448604c6f04a7b7e3589b7560b44af887f999
a097aec561cd83143a72f7d65489c7183215e3a1297972b149e045296fe58f0b
8872a45a4dc167bccd6bacf7fe7a2e1226b6d0d715c254f70b2d11861a580c9e
53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59
3d23669e6b8b3c81723e8d708f6b96775438190207a7ffc2b3250dc8ad9b6d1f
40c6917c29ca6cda32661403a08112ad7cab7e8c3c0cc2f2df43ce304fd2c9a1
8f70dd4f8cba66fe0b0357a900da20e6720b9f61b2bbba69839989b58190d559
0b61c4ae0bb0013d79d4720f22c4f938e8f293c037da2240a95e74796e986cb8
34c5244a7fe3a0020fd8076f8cfaffc646eaeec2a064fafde629f32dd7d271ab
d11caec43b34f3572ca3a4d59e2d017c913bcbc4d285ab108cf20f1a35916b09
e447fb203cee5c45700a06341f0c43bf8103524239fdef0949952621815a101b
cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
107a426d4bc60b1e6ed195a62ad0d6d44f63a6325c64d3e8c64d6a192f05dde3
ac5e423633251a0ef1dfa93455cd0815c4de66e5dad883d0ee5585a423b287a7
139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f
ed9560d7b80ecab2224cf3bc6f60f11108e75f73df736939e3c3a1d4e2d38300
df78f09195d5ea7b410cd19c7d776da01b8249b92db4737968f65d5fa557d5a2
85aa03ee749d1d7f49bc007a396272be71876668f48b6b24d14f8f783d9950a3
3d61aa0e6fba0fc0d2c41a61f004fd50686dc8bdf86b436b9ce113c140795b8f
1aab9cd5703cc04fa54ec81ceb18aeb93c6f689f1135e7a05b99999799212a09
f9d2c41103ef693a7d6faa4a3a398a80f0b79192f9cd74b1b788f5b9f7086e4b
54aec3664b3d47bf3b85f344f1d1f319e2c3ffa88d95442fb7dd6a14f401337f
eae3a488561ff1bb895b0670c0246d254f46c4c32efd8faaceb80e275bc10bb4
12d18151689f567858b9b70740dd5ea1ef379c5bee30384db4241563a5fd6e91
15b76fb2b2e05959ffa7fc6bf458d8dbd7552608c03142822aca07c6049aa1c7
95c0a9a80b1593f42e9b2913d7f23dbe35f801312ae017e5443d3dd2f2959f0a
1517fa5ea2f649735f110e47e4b55323b441718a7e6bf7dee66d27188feb9967
139a3b308c771293d9ab5a2e11cc9f978863082e1268183da77f08414c07c9d1
a383a743b2d24273fefc0a38a33669dce721c91e52a6f845e10d1b36825fa8c6
b17813b2133fd4fbdcdff9dac47d794583dfe73860ee824d1d3ea69a5be2ecde
04ba770c55cfa0531e93dbc85974db72e8019aef649b59234af9dc2d209d0591
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb
bae6e5e9cb4fe232463c52348ba38ccb1cda92f61414bb27b9edd8743197b927
b42a5dfc1af1fca35389fe545756943f0f1de63319a85dc506d99b09ea361154
9ccc75b6167c8c2d0bbc589970726bac57ed8427b5743487765d95782cd09b9e
0736cf7d1a00f10c540cf2c5fbf279c2d788daf350eaa454bfa079ed0811cd17
652a2564ac5fe8c0400d7d3913f516a62c702eef444d6163cd8d3681e6ef97d8
9c70d399d680255b351d6848195098a67f6b06d30bf7b0bee77a2e9666ee5bee
723dd16fe999e4370309cd38ba3e0de8fa6bff08efd74ad952e5e4c2930c0298
78c1fdd8c368ecfea9e0b3fca5c95ed3c5fe9c61e8a6b33ba99391ac229f541f
37055616d9baf9634128ef3f41d36ef85f37adb1cfceb1cfc1476fe7bced51d3
SH256 hash:
3e5ec27ac4a31a1eebdb5b44a8a5fd72c2c64e13aa45246d906ceef0e4ae0490
MD5 hash:
d187d33e0de70c01a4725a266eaf2100
SHA1 hash:
4f492cdfb0925fc541b556f794546fa3b5ec45b2
Detections:
win_nanocore_w0
Create hunting rule
Nanocore_RAT_Gen_2
Create hunting rule
SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24
Create hunting rule
Nanocore_RAT_Feb18_1
Create hunting rule
Nanocore
Create hunting rule
MALWARE_Win_NanoCore
Create hunting rule
Link:
https://www.unpac.me/results/566d03c7-54c8-482e-b9b7-777864ca1329/
Parent samples :
198596f7bb8893e68b762503c8da049f8b263b3c7e5b3210bd7eb1d5c89d7c10
fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
SH256 hash:
ce5186179bfe873eb2891bced787f87a54666f0662be9a73ff5d9d0902e26581
MD5 hash:
4ee72459d5b585e70d4ae2fc656e6714
SHA1 hash:
8e5fdb255304b4cde3ea7af6e6abacfe4d8782a3
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/566d03c7-54c8-482e-b9b7-777864ca1329/
SH256 hash:
61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
MD5 hash:
bdc8945f1d799c845408522e372d1dbd
SHA1 hash:
874b7c3c97cc5b13b9dd172fec5a54bc1f258005
Detections:
Nanocore_RAT_Gen_2
Create hunting rule
Nanocore_RAT_Feb18_1
Create hunting rule
MALWARE_Win_NanoCore
Create hunting rule
Link:
https://www.unpac.me/results/566d03c7-54c8-482e-b9b7-777864ca1329/
Parent samples :
496bbeff36c20e17f2967fb96527b48ab329d1cac12347fdbd8692c46dd36786
91434e57f158bb81625776231e38663bbf467f0bec3048d4c49ed36461ed4724
674427173a5e079caa90209387e6131f19ebafea2f2a0b7c580fa8ea7d4eaa45
874f9ec9a67d5ecb2c131a9aa0c4738af6bc7be28dae7b47c797d8eecdd9961a
c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f
87e9f553b96d552b75210d1a5278039153eedc43e2a10b1166f106e9eba60572
e3f6a75a8004412643549e095af1150d8329a3c46a06aef839842b90d54933a5
340afda65e77e299379392aa25dd7dd040d1a87e51f2249547d083a1d85641df
6e4a05f7b769a8cb12f932281af71be353b058d68a3f96bd00a38b63e78bae70
cfaae9c47bf878627929342f50da998d65f9e7912c5add3c511e6797d4c5f755
1db28735ca3b90340bc6ad5c329f48c62873093d6eaf48ee059610cdebd810e3
020e75bba53b32452b70c2796aabfd51dbd2c82380bf138158ad590d9db1df72
54bfbf52039fe4b62a29452dff37949e356b3baed389a376e6b51192809dbf40
30f5366a61da542dd959a186cf9ae3cbc13efa1d66fcb67631b62cfd8ee52612
8e5e8bda1605fb29ff06b1fc484c6d0d16c0ef92a0cc5567a5f082b9e5bf5634
e3845082f1e4162bc8f91eadb13e63a07d7b985e7322144c0867f364157ea490
ee5b590a1cdcf73ca79216ed770d5fe7d982c812eb7afb86a2e4f4ffda1319a3
4a17d2ac4d53a35e42e4a0ce9aa9e379876f5f961cb4f3a11b789a393878c4f4
a7798c3799df802359d6e7b182f374d413c79ef844097c3f0ae07f9557417a88
149e9d049c83abff4843e0fab7f6cde552aef61e32a53d61e76f6c5adc3db25f
f6b10c59c9ce33c5c8f6b02c3293fe5d479e59542698c91b15af74bcce50ab8f
6ff9daa15f841bf3600d5a9174ab11b921ca8e8f1c9017a1c18afeb514c0f72e
61e7d79adc7462d205a363d9a925f3cb994ffc42c1aad00edc034501b2be5a6d
2aef241c8c48579042670ef2dc6f1cf81fb9b83528c00332daae95950e97dd41
c36013e4224ff11ecd2d2c1eeb69830211e2cfedc94260678ff9ee16590c89dd
4e31d493a6e64c76ff10026b147f95c6f2982860609803d88c8738a26fa3309f
00e69bcba637723de4f9a380800be9b813def689a4d150e0879ef43e3c613361
9d381423ee9f27108e8df36d255f1cfa33e6873ab0d7827d72b47d548293024b
4ba298859e61cb9c39d9d4a4d556fe6357ce0901d5d4ac6f78e6e15ced75cccb
9598d353175682d82d7bbe9eca3d48c97552db2718e77007601f80541b7c8afb
82456f6e550951ab6a0dc2cec4f2b5dc7cdf7e55170afb0589fd01196622e98c
ebaad7382547ccd2a7122e2a991e0b5fabcfc49823e258eaef1c2c57062321a3
8a29c80b0cd5df46f57f94c8934bccb49663e1c2311670875aa1ac48004fbea2
705bc7195bef7a1304004fcd66143fb2943dbc338b21638f4f33f828c31b1e2c
0b9ca6e1597ec89cc959fd7f59820216473675c4178cccc5a533551ab8a61099
7d5c964e4efa00ac05a78f01a08711b4a5be766cd315349df6d385429daad481
e90ec79bd12ab12fe9f1fa7cf0d1914d9c1e996fb779ed3f034601f53512dbe5
49a55a9e822640f53c209e628798a3ccc239fe69af6a690afbd931dc4d7564db
a5ac0dfa706e54b84ea190b833844df140c4d656539d75afddc32d3169869ea3
621368e2459b29bbeb8c83f9154fc48b4461fb687f45888ac8b9b628e3305205
82f800b2cd609858f78b1014e5fe5729059cf520d598aa99d22b97045853eb38
9b68bcf4e287320a6e257953091213ac7e016d7aabc63ee02b0e73e75a782150
451c0c00543d2e11080b0f769b081c95a2a4badaa6604ea3bab382e46326c262
42c3d510fa655fa4f20163b69172a6dff1e990e8630fa465c4cb01c47f50cefe
ee58fa913b4f5d0527453664b762b848404c19c23369ab6c4c893d55adbdde4b
b54e60c9821848c2ed3555992e7a413738176ceee30700fb264b0cda23b6c541
307e36dbfa77c7fe9d4ed5cb61d36a4fada75e7a2db52db3e1df80d222f768d0
5f76a4d34b1fb70d631c3e36bcd0bee199705cf4c15dd6d101246601e702bab6
8348a12f9db7da150a1920718df15448bc7fe34dbe4bc8b788f3d269f940fa3c
6a0b8f403b660202a6d599aa998802af71064fa3cdbbc2377b75885149cf1773
b16c9c6b0d2c5e04fd3d3bcfb9f9a8712502b99a1fea9edf9a2ff1dd1cc8ed41
9f124cc051efd9492f53488f2a60642d552900fb0f70f465e520fee11d60b481
89a1c02dfeab17d26c8a9664588550de3cf2ab3e91cc6c41a89b27daded1ae28
7e2d3731c940e2b0297361d6e75ae67e07b8018ed028e55a04be3cafe84ee99a
3ba9eab166460c7654150897e277fc794361493b3d4e4edd917e0ab22b6dbe6e
be358903e08c518b81313c4cfde845b466a9d638d6924f463b58341274154d10
b2865f04239ad453c02b1baa8aca4f44e9e5d3326c6915056781cea7c0bc733a
d5699a87bb3c073649f980158a31bf8975bdbb0ab51b06c9b0e82d6b2f0b861e
f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0
9411c6d5c0cfddb961ea38414e2af007c8399d93962057fd1e340478565a8b85
79216525955a188f2a55f94514cfe9b9c0c1ce1e116d930cd9c5600dfb46ddfd
c1d29284b6d4ae244712dd49661841b36a6de2387cad6ab55388b22769151878
c39791b8b7ee23adde3bafbf1e5c6acf5c08f94137e2ef8b59a04b6d8760c79d
4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0
c03858657307a20f2da776ba010c76495276e80306c19b70f44342c8bcaece85
3796fdf35ca6c4557746dc1de61e477fe9972bc44a2fb23503e302c27fab4335
0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6
ee66629e98c3278017e7297d3b2b57aac9783a51a46b34046ccc866d10ba4f3c
58bff9dfeb9660c884056b2ffd90e796adbc9e6e6d5292f39609b153c4e2acc0
62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83
88cb52ac93a1552b61addb60481cacb4fbf6dee7f8d307ff87009e38b8e30088
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00
9c91a1b8c4da2d7588f3aecd76cdee7dba24d95f0874f79fa711c0b0a490e273
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c
8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9
2d05c9403bbaab8471cfcc838fea203af7fe69c53041b3320585418d3134c9c6
e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed
2de9fa092d7c352b538462db3b0a9aa757924ad55383b24a61e797cf3cf08372
b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c
b449b20b95c94cd1dc77a0edbd7eb8c183392ff0bbb53f2ca374d129f5ace20a
a3b66fd528f2728fad40ab4eb46c8f1fba303b2c3ca54088fff6223da96c483d
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7
d74b4f0d1c183d485ec71cd226c4fc8e09833fea51856c27d90361c50f39a8bd
005c64147fc04f24b4df3c60be59a4bbfb22066323d269cf10151f25b9a6209a
535a76b11d8e55c1b67db48a5e19521233c2a877f83b65fb6e7edca3257e4a55
b3ecfad7812c038effe03852fe7794bd52d291a97d858245c48ba8fd8408e131
74b5c4b71fb6634b2db9c8501147f6511a376d39dacdfd862d5cd41bf2a7cb08
314295f50f19bc76b802b15a0ec487c50749dc617d48ea91b129ba699e01ff31
95107cbf8e5e80e92bec2ad6da134b55944850fd5306f64efa56cc9dea4a817a
57cf5bd7898d781534ee364e34449af06a9e263b91a4a468aa26098b829942a5
9a32df235b0a6dd55cce4b65a798830e32110264a8e09d578714c0c7389fe7e1
c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17
a9b2c3cfd1964fc818c4ba2955f17482db01a5e6130dcbdc93272c34ddb31343
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d
0211ec291040f1e5ada7c762b20df963381cae88923e3f103d588a382d3a19f3
4bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e
ce3ae4549b58a5304de4c262ac272aa5da715b63edd796de299c861330a4a8d6
a0a4a86c7a612d31e6470cbe01693ccc6190d4aef4cda0735360cc95194708b2
6d233149cf42f476907c45a4e63329d00af0c78d9dafe6f9cc5a38784206db02
3ddf341bb96d5cb94da122b59b38d655ebd8deac277fcaa9244246f7e131ab04
c1c2dca754085aff5214da6e196b7973da114eabc1632d077a505504d950acaf
2f468583af58180a7ce4fd6ca34aeb56bb7e7fc2738d1ba6df62accfd61bd3ec
6c22578a9080fc7f38d949df46f1bb88f386fd17ad76d78cac31e5b7782a2685
3af587731a4050cb520beeb1b67fd2d0654db2edf3968945419218b85461b568
4a842606d80e5bc30a9817fc11877889b24e3daccc2ba7ea0711d5c259e70226
8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520
87df6e5a5e0a50b6d49e15500f70588476991ef2ce6b6a745ab5164314a34fcf
c56b0068b210b206f7c93062eb115654919ea50fcb21a35391b25e33fcf92af2
48e087544d3e050da9c8e86b2f18636ad1ef475d158f4d0c1eb09b7fdaa21dcc
ebab7ddccea1d6b5a5d4e69bf2dccd2684fc00f5955ca5e6bc5bc51833247232
1e4d548172c9ed335ba2d27c2476d9bd8751b1a50361fa27b5ebc87b5a21d9fe
e1ebcf818a956afb18a8d62551d16cfbe7876894dd4190bf7f4ff4565b3d2c74
a317bcadef76feec57223d92244a322eb4409990808a7bab96cc929fbc4a7164
70494a9ed1d509c12c48aa4dc68f06f73bee77a18a625b576dd515e9f4e0d6c3
058e2c02b8cfb93b480ea8cfac08e967b39631a579256ebee27fb7472194c1ea
9dacb1dfc8347248dffc1a1bfcbf07060bc5fa5700f24558487083c4e3001029
a920dfb486d57b7d60d6bad4643d4f425802ce9ac8c520f9771d6689b65ffe80
2634af4fb7d0c056e1f96809592bfcd3ee9f3fedf0ad52f9340b67d3b67d9f0a
0f1d6aab547ceca6e71ac2e5a54afdaea597318fe7b6ca337f5b92fdff596168
71a22bed7ab5a26158fc1cf1b7bb87146254672483aad72736817ff16e656c7b
8ebd2e57f1a64a6d1251ccdc21eddc4dc7afe05385dbf7123bb5e291d94437c2
e49189557147abb38b584bb167b436947cde7bcea7ab44815ebc44c4f21e1870
dceafff25f376bd3883f15c500fbfe369b45821fdbb0e34caa0bc715f5e34ad2
03f869fc2438617cbd973ac052b07fdef9b3f5d67e0df12a2e43307b6c477db0
49b88f74282203ff9472be70da1695613b5516d0531c3e7a424f9de8cdb19a0d
a9b8879292fbf7bd63b7880cf9e1084040aa1c9adaf0b0f2d05e721696aae161
710ff75d5a2cbf5c03f0d614b6be6f7a74c32be8108427648445ea1acd8a3cdf
4b18e456fb558a50380ebfb7c02fd98814fc4b41aa0f3a62c3286b633927ebb2
84dbca2e531d9204bc920e15f1764606113509ba358c1fea1df10ef8cf457351
691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8
1a9dc2fbfe2257278e6452872cdbd18c50bf5c7142dd04c772f1633a7f20fd0d
532c53d2a5602525fef8ca7c49a3e3990bb352f8a07373e599736dcc1174ef96
e207ac84a52789e4f93b901bdc24a0b9930759d50aab651cc3d5d1f3be7a3e44
0bbff62a45fc9776575ed143af2d7db332e2781d7e3de56eb3ff48c25d0c7b46
f068cde1b80e9acc6043f24115c61b71d9badd63535ba1e08f8ea41fc378be67
aab512030974507c73bfa580ea67ffba4629ea44ab61c60ae0b85560c97e1867
01188fbf53b8744fc691385286b90af699970de02a6cf55f9da86b1c27d53f37
d2da6a437828e06a68fb1d9ec12df9bccd142b5f5fb0f489efb2234092887dab
782cf5337d8a428867a0ab13d474628b427dbb1164d4449f7e8dc96bdab3c7b1
da551ab6e000732499227a67f2be68d1256b58d95963a903cc316e2730db9d1e
54c028b0bb2728975b22d500df2164a3218670a3db6cb8a9a31654fdc2b8a20b
fcf8b6406f92a604fa5f8972fc48e55c1790a63abbcb72811984e35515cdf058
d3d5963442e6c36209ec3b38d4e16600283423af9c2a212291bb6cd7e8a837e7
c3e019a0502617286408630187c0e19eb146ee3d70e0b9e0390d9e3763e041bc
6cc902a129311aaac4f40644029251ed2fc60a9138cb705d85e556deaf5d5cff
a3f21e7d47d2f78d8487048e2b5e24f6e9a8279d18261405eba4ce33aa98bb17
5d700fc9a4aa2e6fe9df0c256f429f8a2ff303b4edd3bf496b730439b15e2017
54efbc967b2433aa4d3300c7a0366f23e87da1d8e00edf4087dd4b0df34c8e41
cb68ffe5da24d5fcff1699198094954a32185a05cd8d5d61c85ddff66c066a46
0194a7dba29d62fe979b70e944ca6ace74beb02c29aa3217099e6db896c768f8
21f3851df5c3487b850c88275818072eb000857423f72608b0708b53bb3bbf64
60de37f8965472ff0581e060db7950e8d198495538822fa5866c0e7ab8f787e5
198596f7bb8893e68b762503c8da049f8b263b3c7e5b3210bd7eb1d5c89d7c10
9307ca0fb898698d7bd9691885f4906233821a5ea65fd882c38e4b02e79da6fe
fed673ec9b344292155fa81c6339ce0acd7c832b561a9256c5376d2b8fc1823c
86c1673543da8b4d4d48dfa2e244deef173c3b6e7d5c0fab49b4c3a1ba84dc7b
2b0955e7f2522416b0b3612193de1d962d1e14135de76b5bed230c28f4eac356
7fed8bf46a38e2137c71fc6321a677baac19dadada52490724eb94f0ead36ad6
6887df1574fb46f18f7104d39016288cda522e4f12fa62684abd79ede10be6cc
fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
38ab71edd7d7bea5523ed8b92132d478b3908985aa7c8e1795982e611b33e445
c63b71399802b4e604af2072be8478de196ff17458567af2932efd63a2cf2641
0d7e42be68fac7820630de7f5c40868bae2a9c14f1436968ae462ee1d46555ac
bf90356a990236ed0cca1408f0c6cf4fe6cc70aad795ed254f69e29036ef5b67
f3f29bda95399edcd735bb64133d3dc5def59daae166c10ce983cd6aa3887d75
2aa789a884445cc20d9911635e40580f50fd9bb2c1408eb6e0075240ecbb4a65
f48da598062316a0cfb08df3bf30f916635a9ab3d76982c821bd9973aea64023
7c563e7249a222861f18b8155e331465ad1989f4a794b6d8dbdc95a146c9b2ed
def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf
2de12846ff14d4cfa6de2b49b16ed9a9352e1164dfe9c5af84d07c6b11b41067
817b107280c2c8c7996f811be94b696d978fbfa943a4d84b2f95486190e2335d
716d1d177e45a0ea675d274d582ba39a839d749e48709ce25c0ec0df77f0e073
2fb2a47cf39a1551639d130205a1557a45600f3eb8ecbec658c16c477a476f8b
d7cff825f5646c6193712cdb25d267850b3198db1b8709f0a411645f0763f9e4
0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff
ccd665e0a79f33c8823d9a855c722c496a8670c05d559254460e9c304daea4dc
1d9b47e8366507c23d81a11dfbc4f5e54c95f6a4b778da0c5990feb28751bdae
9e79e11cbe6aa1007eb645b8da4dd7ce5fdd9f3f2b7f4b19b3f89802c164f253
6ff47485544ecf739493816572006c668a31401f0620daa135b7c7feccb4a845
6bf1d4c59a3f39d888bd56464c6fbe1b3c3710abc01fa375351e5175f2b9fa45
2009d690b1953fa11543c8b7003cbab8bd1c84c2ff67947f65fb6d321b8b38f7
19faa35e4a88f88a37632b1ddb78318c66f38210d7662c4a0103f8472c518c30
4d5c94ee188d2b20cc91fa680b6a81a59a61ac93fc7e822dcd58be0310fd7768
ac5fa0b95eb652ea20dfe2764447f4dd75e33036c9ed1ece7b27acbf58b3d476
c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281
887a04c14e639bee44b1ebe4c110004818f8f33d2fb1ab14e88fa25fa44fc88a
27c7707f233afac647ecb4e9dc4f7bbee3bcde358832b8c09586d9006993bfd5
cd6b5814bf7ec58c93e212db21c3045491b15683d6b9a1b4a47da4837ca991b0
26053f3d63255bbc73f31dc611c7ef63cfd75b28dfd800bc7b9a11bb578ed89e
ee976be94fb6437e5309b6b99354657e401e371aa9e17f7665f60f8474b74dd8
0c7b70edd8d840be99456cf9e35ca9ac9e341b6e83875745511d60da15661a6a
a6bc2fb206efe4340b16945ebebfeb7e30bf5d3cbad01eff2ee26120febdc627
b41af469b3606ca663b503bebe27ccbab1895b2ccf19e33fc26a38a243b44514
d5fb06d1399ffd954b8d1dc1bd81521c4010acc244cb8bf99a8f9c83697e332f
aa4adbda7daad239a268c41c7735506d3fa7e65eceed44c72f4970696b68dbef
ff9c7d024d2c1e379be44e420c9061d29b335a367492d6d7ce957a8a52628d3d
ee5c5ba42032ee6a64f4fe4e3bf490c96275a6e4f7f53299286357f5c0adbed9
eda128c2be30349721286d162089e9bd3d4d956e06c902d25826a6364c641404
ea90b2b47e8d066d16c597cc1db8d77734d2ed209835e836f5aaa0c6dc2d5c93
339d2c7c00043ef1ffa01080771fc2392d4b693dd822370511201f5bf0f45f28
541705f1e268cdaac90869bb557cd7b15c29cf6c01ca2ac6fd17f5e3953d394e
5210d712006b4a9f71bc3862c38d09dc2f65b27e35629e9e1192290db73be935
2d487e83f730e2f03f5a39cdaf7959597abcb588533f883ae6b02eeeafe1fcf4
b56604d2a0c55a77b35a3cb6049b12f4dc2bb964f965b90b9657a00903e0d417
f99a35529d49c648c01518eb567398141b2ad7a809f88618c75b6f637cae3926
480a1166729945af333cf8a6f5d51a4ed13ac5e4af1487ecea6e87f7aefbf656
ac7c3c0c3906c4d93e34b91fa34941277f044ac26d037c113c9756a4f18619dd
677ce0d368b44c16550269a5f337c5d8c67cf025664c614ab1add706627b0594
1ea022e39cb9cf37fbfdc1f6b2b4cd2dff64793c981312963894ecf2d34587a9
de2aae7cad657545766fd4b88337a5474434c57006e56c149bd2138fe6b035bc
a22cff1b630771a330a605a71829ad0a113446b40a38044b5b5ce55df6cc2fc8
1494410b9ffbf0bbe4efe4048c41afef4cc75c32b16f9450485e5f22f298fd3a
2688dbf43420b3799d79c51e0fc776d7dc840a2eb925f7214cdd17324b0798fe
741c421367b548b8b45e8ddeb4e8fb735c7b1bd22d4c557841eb299bc0db4bb1
SH256 hash:
01e3b18bd63981decb384f558f0321346c3334bb6e6f97c31c6c95c4ab2fe354
MD5 hash:
9c8242440c47a4f1ce2e47df3c3ddd28
SHA1 hash:
874f3caf663265f7dd18fb565d91b7d915031251
Detections:
Nanocore_RAT_Gen_2
Create hunting rule
Nanocore_RAT_Feb18_1
Create hunting rule
MALWARE_Win_NanoCore
Create hunting rule
SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/566d03c7-54c8-482e-b9b7-777864ca1329/
Parent samples :
496bbeff36c20e17f2967fb96527b48ab329d1cac12347fdbd8692c46dd36786
91434e57f158bb81625776231e38663bbf467f0bec3048d4c49ed36461ed4724
674427173a5e079caa90209387e6131f19ebafea2f2a0b7c580fa8ea7d4eaa45
874f9ec9a67d5ecb2c131a9aa0c4738af6bc7be28dae7b47c797d8eecdd9961a
c8f3302ef072664c135d2a3049637db8ae72058f63fbfedc67dfcedebf4d236f
87e9f553b96d552b75210d1a5278039153eedc43e2a10b1166f106e9eba60572
e3f6a75a8004412643549e095af1150d8329a3c46a06aef839842b90d54933a5
340afda65e77e299379392aa25dd7dd040d1a87e51f2249547d083a1d85641df
6e4a05f7b769a8cb12f932281af71be353b058d68a3f96bd00a38b63e78bae70
cfaae9c47bf878627929342f50da998d65f9e7912c5add3c511e6797d4c5f755
1db28735ca3b90340bc6ad5c329f48c62873093d6eaf48ee059610cdebd810e3
020e75bba53b32452b70c2796aabfd51dbd2c82380bf138158ad590d9db1df72
54bfbf52039fe4b62a29452dff37949e356b3baed389a376e6b51192809dbf40
30f5366a61da542dd959a186cf9ae3cbc13efa1d66fcb67631b62cfd8ee52612
8e5e8bda1605fb29ff06b1fc484c6d0d16c0ef92a0cc5567a5f082b9e5bf5634
e3845082f1e4162bc8f91eadb13e63a07d7b985e7322144c0867f364157ea490
ee5b590a1cdcf73ca79216ed770d5fe7d982c812eb7afb86a2e4f4ffda1319a3
4a17d2ac4d53a35e42e4a0ce9aa9e379876f5f961cb4f3a11b789a393878c4f4
a7798c3799df802359d6e7b182f374d413c79ef844097c3f0ae07f9557417a88
149e9d049c83abff4843e0fab7f6cde552aef61e32a53d61e76f6c5adc3db25f
f6b10c59c9ce33c5c8f6b02c3293fe5d479e59542698c91b15af74bcce50ab8f
6ff9daa15f841bf3600d5a9174ab11b921ca8e8f1c9017a1c18afeb514c0f72e
61e7d79adc7462d205a363d9a925f3cb994ffc42c1aad00edc034501b2be5a6d
2aef241c8c48579042670ef2dc6f1cf81fb9b83528c00332daae95950e97dd41
c36013e4224ff11ecd2d2c1eeb69830211e2cfedc94260678ff9ee16590c89dd
4e31d493a6e64c76ff10026b147f95c6f2982860609803d88c8738a26fa3309f
00e69bcba637723de4f9a380800be9b813def689a4d150e0879ef43e3c613361
9d381423ee9f27108e8df36d255f1cfa33e6873ab0d7827d72b47d548293024b
4ba298859e61cb9c39d9d4a4d556fe6357ce0901d5d4ac6f78e6e15ced75cccb
9598d353175682d82d7bbe9eca3d48c97552db2718e77007601f80541b7c8afb
82456f6e550951ab6a0dc2cec4f2b5dc7cdf7e55170afb0589fd01196622e98c
ebaad7382547ccd2a7122e2a991e0b5fabcfc49823e258eaef1c2c57062321a3
8a29c80b0cd5df46f57f94c8934bccb49663e1c2311670875aa1ac48004fbea2
705bc7195bef7a1304004fcd66143fb2943dbc338b21638f4f33f828c31b1e2c
0b9ca6e1597ec89cc959fd7f59820216473675c4178cccc5a533551ab8a61099
7d5c964e4efa00ac05a78f01a08711b4a5be766cd315349df6d385429daad481
e90ec79bd12ab12fe9f1fa7cf0d1914d9c1e996fb779ed3f034601f53512dbe5
49a55a9e822640f53c209e628798a3ccc239fe69af6a690afbd931dc4d7564db
a5ac0dfa706e54b84ea190b833844df140c4d656539d75afddc32d3169869ea3
621368e2459b29bbeb8c83f9154fc48b4461fb687f45888ac8b9b628e3305205
82f800b2cd609858f78b1014e5fe5729059cf520d598aa99d22b97045853eb38
9b68bcf4e287320a6e257953091213ac7e016d7aabc63ee02b0e73e75a782150
451c0c00543d2e11080b0f769b081c95a2a4badaa6604ea3bab382e46326c262
42c3d510fa655fa4f20163b69172a6dff1e990e8630fa465c4cb01c47f50cefe
ee58fa913b4f5d0527453664b762b848404c19c23369ab6c4c893d55adbdde4b
b54e60c9821848c2ed3555992e7a413738176ceee30700fb264b0cda23b6c541
307e36dbfa77c7fe9d4ed5cb61d36a4fada75e7a2db52db3e1df80d222f768d0
5f76a4d34b1fb70d631c3e36bcd0bee199705cf4c15dd6d101246601e702bab6
8348a12f9db7da150a1920718df15448bc7fe34dbe4bc8b788f3d269f940fa3c
6a0b8f403b660202a6d599aa998802af71064fa3cdbbc2377b75885149cf1773
b16c9c6b0d2c5e04fd3d3bcfb9f9a8712502b99a1fea9edf9a2ff1dd1cc8ed41
9f124cc051efd9492f53488f2a60642d552900fb0f70f465e520fee11d60b481
89a1c02dfeab17d26c8a9664588550de3cf2ab3e91cc6c41a89b27daded1ae28
7e2d3731c940e2b0297361d6e75ae67e07b8018ed028e55a04be3cafe84ee99a
3ba9eab166460c7654150897e277fc794361493b3d4e4edd917e0ab22b6dbe6e
be358903e08c518b81313c4cfde845b466a9d638d6924f463b58341274154d10
b2865f04239ad453c02b1baa8aca4f44e9e5d3326c6915056781cea7c0bc733a
d5699a87bb3c073649f980158a31bf8975bdbb0ab51b06c9b0e82d6b2f0b861e
f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0
9411c6d5c0cfddb961ea38414e2af007c8399d93962057fd1e340478565a8b85
79216525955a188f2a55f94514cfe9b9c0c1ce1e116d930cd9c5600dfb46ddfd
c1d29284b6d4ae244712dd49661841b36a6de2387cad6ab55388b22769151878
c39791b8b7ee23adde3bafbf1e5c6acf5c08f94137e2ef8b59a04b6d8760c79d
4cef1677e5e896054778060ec165cb35bcc4c923a38ea7eea43609dea20492f0
c03858657307a20f2da776ba010c76495276e80306c19b70f44342c8bcaece85
3796fdf35ca6c4557746dc1de61e477fe9972bc44a2fb23503e302c27fab4335
0117ba3b90a77a00da548bf15490d6623de69e535d75fbbce8279b91c82f5ef6
ee66629e98c3278017e7297d3b2b57aac9783a51a46b34046ccc866d10ba4f3c
58bff9dfeb9660c884056b2ffd90e796adbc9e6e6d5292f39609b153c4e2acc0
62ce4e89f91a70f82f5a61bf76c4ab592982f761eef609bd7ea7b196f9415e83
88cb52ac93a1552b61addb60481cacb4fbf6dee7f8d307ff87009e38b8e30088
1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00
9c91a1b8c4da2d7588f3aecd76cdee7dba24d95f0874f79fa711c0b0a490e273
b0ad6f779e4a72a0e75bb48eec11e8b2f270c95078054e9559505efce6a25c8c
8008ab1db4e5ce83daea144f7ff2c2c81f10f73843fc1ddba4040426a54fd1a9
2d05c9403bbaab8471cfcc838fea203af7fe69c53041b3320585418d3134c9c6
e346a199826939f2970cdd5337010e08cd761c0dfa35965afb404a04489ec0ed
2de9fa092d7c352b538462db3b0a9aa757924ad55383b24a61e797cf3cf08372
b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c
b449b20b95c94cd1dc77a0edbd7eb8c183392ff0bbb53f2ca374d129f5ace20a
a3b66fd528f2728fad40ab4eb46c8f1fba303b2c3ca54088fff6223da96c483d
26321ed18abb4d44668e157dcb9a123debe3b7477d95055d20e5f5d997bf60d7
d74b4f0d1c183d485ec71cd226c4fc8e09833fea51856c27d90361c50f39a8bd
005c64147fc04f24b4df3c60be59a4bbfb22066323d269cf10151f25b9a6209a
535a76b11d8e55c1b67db48a5e19521233c2a877f83b65fb6e7edca3257e4a55
b3ecfad7812c038effe03852fe7794bd52d291a97d858245c48ba8fd8408e131
74b5c4b71fb6634b2db9c8501147f6511a376d39dacdfd862d5cd41bf2a7cb08
314295f50f19bc76b802b15a0ec487c50749dc617d48ea91b129ba699e01ff31
95107cbf8e5e80e92bec2ad6da134b55944850fd5306f64efa56cc9dea4a817a
57cf5bd7898d781534ee364e34449af06a9e263b91a4a468aa26098b829942a5
9a32df235b0a6dd55cce4b65a798830e32110264a8e09d578714c0c7389fe7e1
c00ff750da6d963181a49a76e0ec0c39bd58fa6f8926227543c3d65246ac4a17
a9b2c3cfd1964fc818c4ba2955f17482db01a5e6130dcbdc93272c34ddb31343
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d
0211ec291040f1e5ada7c762b20df963381cae88923e3f103d588a382d3a19f3
4bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e
ce3ae4549b58a5304de4c262ac272aa5da715b63edd796de299c861330a4a8d6
a0a4a86c7a612d31e6470cbe01693ccc6190d4aef4cda0735360cc95194708b2
6d233149cf42f476907c45a4e63329d00af0c78d9dafe6f9cc5a38784206db02
3ddf341bb96d5cb94da122b59b38d655ebd8deac277fcaa9244246f7e131ab04
c1c2dca754085aff5214da6e196b7973da114eabc1632d077a505504d950acaf
2f468583af58180a7ce4fd6ca34aeb56bb7e7fc2738d1ba6df62accfd61bd3ec
6c22578a9080fc7f38d949df46f1bb88f386fd17ad76d78cac31e5b7782a2685
3af587731a4050cb520beeb1b67fd2d0654db2edf3968945419218b85461b568
4a842606d80e5bc30a9817fc11877889b24e3daccc2ba7ea0711d5c259e70226
8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520
87df6e5a5e0a50b6d49e15500f70588476991ef2ce6b6a745ab5164314a34fcf
c56b0068b210b206f7c93062eb115654919ea50fcb21a35391b25e33fcf92af2
48e087544d3e050da9c8e86b2f18636ad1ef475d158f4d0c1eb09b7fdaa21dcc
ebab7ddccea1d6b5a5d4e69bf2dccd2684fc00f5955ca5e6bc5bc51833247232
1e4d548172c9ed335ba2d27c2476d9bd8751b1a50361fa27b5ebc87b5a21d9fe
e1ebcf818a956afb18a8d62551d16cfbe7876894dd4190bf7f4ff4565b3d2c74
a317bcadef76feec57223d92244a322eb4409990808a7bab96cc929fbc4a7164
70494a9ed1d509c12c48aa4dc68f06f73bee77a18a625b576dd515e9f4e0d6c3
058e2c02b8cfb93b480ea8cfac08e967b39631a579256ebee27fb7472194c1ea
9dacb1dfc8347248dffc1a1bfcbf07060bc5fa5700f24558487083c4e3001029
a920dfb486d57b7d60d6bad4643d4f425802ce9ac8c520f9771d6689b65ffe80
2634af4fb7d0c056e1f96809592bfcd3ee9f3fedf0ad52f9340b67d3b67d9f0a
0f1d6aab547ceca6e71ac2e5a54afdaea597318fe7b6ca337f5b92fdff596168
71a22bed7ab5a26158fc1cf1b7bb87146254672483aad72736817ff16e656c7b
8ebd2e57f1a64a6d1251ccdc21eddc4dc7afe05385dbf7123bb5e291d94437c2
e49189557147abb38b584bb167b436947cde7bcea7ab44815ebc44c4f21e1870
dceafff25f376bd3883f15c500fbfe369b45821fdbb0e34caa0bc715f5e34ad2
03f869fc2438617cbd973ac052b07fdef9b3f5d67e0df12a2e43307b6c477db0
49b88f74282203ff9472be70da1695613b5516d0531c3e7a424f9de8cdb19a0d
a9b8879292fbf7bd63b7880cf9e1084040aa1c9adaf0b0f2d05e721696aae161
710ff75d5a2cbf5c03f0d614b6be6f7a74c32be8108427648445ea1acd8a3cdf
4b18e456fb558a50380ebfb7c02fd98814fc4b41aa0f3a62c3286b633927ebb2
84dbca2e531d9204bc920e15f1764606113509ba358c1fea1df10ef8cf457351
691c9052e43556c9e4fbbec1db2f27bb448bdc3ee6492a648ff0a5b53d35b5e8
1a9dc2fbfe2257278e6452872cdbd18c50bf5c7142dd04c772f1633a7f20fd0d
532c53d2a5602525fef8ca7c49a3e3990bb352f8a07373e599736dcc1174ef96
e207ac84a52789e4f93b901bdc24a0b9930759d50aab651cc3d5d1f3be7a3e44
0bbff62a45fc9776575ed143af2d7db332e2781d7e3de56eb3ff48c25d0c7b46
f068cde1b80e9acc6043f24115c61b71d9badd63535ba1e08f8ea41fc378be67
aab512030974507c73bfa580ea67ffba4629ea44ab61c60ae0b85560c97e1867
01188fbf53b8744fc691385286b90af699970de02a6cf55f9da86b1c27d53f37
d2da6a437828e06a68fb1d9ec12df9bccd142b5f5fb0f489efb2234092887dab
782cf5337d8a428867a0ab13d474628b427dbb1164d4449f7e8dc96bdab3c7b1
da551ab6e000732499227a67f2be68d1256b58d95963a903cc316e2730db9d1e
54c028b0bb2728975b22d500df2164a3218670a3db6cb8a9a31654fdc2b8a20b
fcf8b6406f92a604fa5f8972fc48e55c1790a63abbcb72811984e35515cdf058
d3d5963442e6c36209ec3b38d4e16600283423af9c2a212291bb6cd7e8a837e7
c3e019a0502617286408630187c0e19eb146ee3d70e0b9e0390d9e3763e041bc
6cc902a129311aaac4f40644029251ed2fc60a9138cb705d85e556deaf5d5cff
a3f21e7d47d2f78d8487048e2b5e24f6e9a8279d18261405eba4ce33aa98bb17
5d700fc9a4aa2e6fe9df0c256f429f8a2ff303b4edd3bf496b730439b15e2017
54efbc967b2433aa4d3300c7a0366f23e87da1d8e00edf4087dd4b0df34c8e41
cb68ffe5da24d5fcff1699198094954a32185a05cd8d5d61c85ddff66c066a46
0194a7dba29d62fe979b70e944ca6ace74beb02c29aa3217099e6db896c768f8
21f3851df5c3487b850c88275818072eb000857423f72608b0708b53bb3bbf64
60de37f8965472ff0581e060db7950e8d198495538822fa5866c0e7ab8f787e5
198596f7bb8893e68b762503c8da049f8b263b3c7e5b3210bd7eb1d5c89d7c10
9307ca0fb898698d7bd9691885f4906233821a5ea65fd882c38e4b02e79da6fe
fed673ec9b344292155fa81c6339ce0acd7c832b561a9256c5376d2b8fc1823c
86c1673543da8b4d4d48dfa2e244deef173c3b6e7d5c0fab49b4c3a1ba84dc7b
2b0955e7f2522416b0b3612193de1d962d1e14135de76b5bed230c28f4eac356
7fed8bf46a38e2137c71fc6321a677baac19dadada52490724eb94f0ead36ad6
6887df1574fb46f18f7104d39016288cda522e4f12fa62684abd79ede10be6cc
fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
38ab71edd7d7bea5523ed8b92132d478b3908985aa7c8e1795982e611b33e445
c63b71399802b4e604af2072be8478de196ff17458567af2932efd63a2cf2641
0d7e42be68fac7820630de7f5c40868bae2a9c14f1436968ae462ee1d46555ac
bf90356a990236ed0cca1408f0c6cf4fe6cc70aad795ed254f69e29036ef5b67
f3f29bda95399edcd735bb64133d3dc5def59daae166c10ce983cd6aa3887d75
2aa789a884445cc20d9911635e40580f50fd9bb2c1408eb6e0075240ecbb4a65
f48da598062316a0cfb08df3bf30f916635a9ab3d76982c821bd9973aea64023
7c563e7249a222861f18b8155e331465ad1989f4a794b6d8dbdc95a146c9b2ed
def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf
2de12846ff14d4cfa6de2b49b16ed9a9352e1164dfe9c5af84d07c6b11b41067
817b107280c2c8c7996f811be94b696d978fbfa943a4d84b2f95486190e2335d
716d1d177e45a0ea675d274d582ba39a839d749e48709ce25c0ec0df77f0e073
2fb2a47cf39a1551639d130205a1557a45600f3eb8ecbec658c16c477a476f8b
d7cff825f5646c6193712cdb25d267850b3198db1b8709f0a411645f0763f9e4
0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff
ccd665e0a79f33c8823d9a855c722c496a8670c05d559254460e9c304daea4dc
1d9b47e8366507c23d81a11dfbc4f5e54c95f6a4b778da0c5990feb28751bdae
9e79e11cbe6aa1007eb645b8da4dd7ce5fdd9f3f2b7f4b19b3f89802c164f253
6ff47485544ecf739493816572006c668a31401f0620daa135b7c7feccb4a845
6bf1d4c59a3f39d888bd56464c6fbe1b3c3710abc01fa375351e5175f2b9fa45
2009d690b1953fa11543c8b7003cbab8bd1c84c2ff67947f65fb6d321b8b38f7
19faa35e4a88f88a37632b1ddb78318c66f38210d7662c4a0103f8472c518c30
4d5c94ee188d2b20cc91fa680b6a81a59a61ac93fc7e822dcd58be0310fd7768
ac5fa0b95eb652ea20dfe2764447f4dd75e33036c9ed1ece7b27acbf58b3d476
c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281
887a04c14e639bee44b1ebe4c110004818f8f33d2fb1ab14e88fa25fa44fc88a
27c7707f233afac647ecb4e9dc4f7bbee3bcde358832b8c09586d9006993bfd5
cd6b5814bf7ec58c93e212db21c3045491b15683d6b9a1b4a47da4837ca991b0
26053f3d63255bbc73f31dc611c7ef63cfd75b28dfd800bc7b9a11bb578ed89e
ee976be94fb6437e5309b6b99354657e401e371aa9e17f7665f60f8474b74dd8
0c7b70edd8d840be99456cf9e35ca9ac9e341b6e83875745511d60da15661a6a
a6bc2fb206efe4340b16945ebebfeb7e30bf5d3cbad01eff2ee26120febdc627
b41af469b3606ca663b503bebe27ccbab1895b2ccf19e33fc26a38a243b44514
d5fb06d1399ffd954b8d1dc1bd81521c4010acc244cb8bf99a8f9c83697e332f
aa4adbda7daad239a268c41c7735506d3fa7e65eceed44c72f4970696b68dbef
ff9c7d024d2c1e379be44e420c9061d29b335a367492d6d7ce957a8a52628d3d
ee5c5ba42032ee6a64f4fe4e3bf490c96275a6e4f7f53299286357f5c0adbed9
eda128c2be30349721286d162089e9bd3d4d956e06c902d25826a6364c641404
ea90b2b47e8d066d16c597cc1db8d77734d2ed209835e836f5aaa0c6dc2d5c93
339d2c7c00043ef1ffa01080771fc2392d4b693dd822370511201f5bf0f45f28
541705f1e268cdaac90869bb557cd7b15c29cf6c01ca2ac6fd17f5e3953d394e
5210d712006b4a9f71bc3862c38d09dc2f65b27e35629e9e1192290db73be935
2d487e83f730e2f03f5a39cdaf7959597abcb588533f883ae6b02eeeafe1fcf4
b56604d2a0c55a77b35a3cb6049b12f4dc2bb964f965b90b9657a00903e0d417
f99a35529d49c648c01518eb567398141b2ad7a809f88618c75b6f637cae3926
480a1166729945af333cf8a6f5d51a4ed13ac5e4af1487ecea6e87f7aefbf656
ac7c3c0c3906c4d93e34b91fa34941277f044ac26d037c113c9756a4f18619dd
677ce0d368b44c16550269a5f337c5d8c67cf025664c614ab1add706627b0594
1ea022e39cb9cf37fbfdc1f6b2b4cd2dff64793c981312963894ecf2d34587a9
de2aae7cad657545766fd4b88337a5474434c57006e56c149bd2138fe6b035bc
a22cff1b630771a330a605a71829ad0a113446b40a38044b5b5ce55df6cc2fc8
1494410b9ffbf0bbe4efe4048c41afef4cc75c32b16f9450485e5f22f298fd3a
2688dbf43420b3799d79c51e0fc776d7dc840a2eb925f7214cdd17324b0798fe
741c421367b548b8b45e8ddeb4e8fb735c7b1bd22d4c557841eb299bc0db4bb1
SH256 hash:
f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec
MD5 hash:
42006852619847f368bc4062849cd6dc
SHA1 hash:
ba6edc3a5aba8eac15b6a30e1407cdae80b2481d
Link:
https://www.unpac.me/results/566d03c7-54c8-482e-b9b7-777864ca1329/
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fef63e35d792/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:malware_Nanocore_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:MALWARE_Win_NanoCore
Create hunting rule
Author:ditekSHen
Description:Detects NanoCore
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Feb18_1_RID2DF1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:Nanocore_RAT_Gen_2_RID2D96
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Nanocore_d8c4e3c5
Create hunting rule
Author:Elastic Security
Rule name:win_nanocore_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/5435/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments