MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff16fdbe3781373baa856a3858c83f8a6551f7dfe808265e9f9d876676c79212. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	ff16fdbe3781373baa856a3858c83f8a6551f7dfe808265e9f9d876676c79212
SHA3-384 hash:	ebddc094c961122d146e09f995eef7678e146650236799aa948189e9b66cfc86b1fc9f2283be29c8d8648371aef96149
SHA1 hash:	231d2f3b62bf900e548187cd28a78ae829aaa29d
MD5 hash:	b45914a5ac009191ba1a63eb4242061f
humanhash:	bacon-hamper-mars-spring
File name:	Bank Request Form.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	381'440 bytes
First seen:	2020-06-24 06:40:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:tohdnseMXxsKUfVoYKcZTBO4yl80A9HRmxqwqvIt0T8KpnTcMdmz34LxT:tEMXtU3ZFOZGd9HYxq7I/KppdU6
Threatray	1'196 similar samples on MalwareBazaar
TLSH	2B84DF073B58B6A7CA7885F6C4917A4813FD1D9A6363F2D62CC032941AF3BDA45236C7
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: smt-group.com
Sending IP: 193.56.28.145
From: Wong Shu Heng<info@smt-group.com>
Subject: Payment/Remittance Returned To Our Bank
Attachment: Bank Request Form.rar (contains "Bank Request Form.exe")

NanoCore RAT C2:
ome2j3bw.3utilities.com:1907 (185.165.153.18)

Pointing to nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacy-matters.co'

inetnum: 185.165.153.0 - 185.165.153.255
netname: PRIVACY_MATTERS
remarks: This prefix belongs to a VPN service provider.
remarks: For us the privacy of our customers matters, which means we store no logs
remarks: related to any IP addresses.
remarks: Spamhaus, please note that blacklisting the clean prefixes of our hosting
remarks: partners and upstream providers is an act of coercion and will no longer
remarks: be tolerated.
remarks: Coercion is punishable by a custodial sentence or by a monetary penalty.
remarks: If you continue such practice we will not only take legal actions against
remarks: your organization, but also make such blackmailing attempts public in the
remarks: media.
country: AT
admin-c: PMVS3-RIPE
tech-c: PMVS3-RIPE
org: ORG-PMVS1-RIPE
status: ASSIGNED PA
mnt-by: PM-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2019-10-18T13:31:16Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/13493/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/ff16fdbe3781373baa856a3858c83f8a6551f7dfe808265e9f9d876676c79212/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-24 06:42:07 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=74lp3prxqe3txkufni4frsb7rjsvd5675aecmxu7twdwm5whsija._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

428b0c27a13b633a5bcde725ce2859eb38d943d2437d3652c17ed78176521371

NanoCore

4edb517cd43eef725ea3c5dfeadec190b933e408ec6f8de0d093c18a80e8bef8

NanoCore

6367861a95be41d6a75f68ed68a361b88aa93cfce0069376d27a215650d4a4c7

NanoCore

8ce08c8d5299a9b14573f34240c4ca253ad1e96247cbb3ee1346d51f44f2b21c

NanoCore

8f88c71422c2790790dd50c3ff89fe3a5add4e1d55a83e50d6b445779d813796

NanoCore

953b28fd61cb8eb78e1fca699aead009a12bb5a0a6a8d42b0447cbe2bf828143

NanoCore

c38c88878a7c284cd19149b2efb91129b16ae51c6ff32badb2622122185f1692

NanoCore

eb25701a60ba1d70a724b60de9d24b4931eece2e71f649236c31afd43ad170d7

NanoCore

f6418cb1cf7a9024b0a8e7f736c45f0a7e8aaa5ecd2d41241f20a56ea05ccf07

NanoCore

+ 1'186 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

evasion trojan keylogger stealer spyware family:nanocore persistence

Link:

https://tria.ge/reports/200624-1s4p7rc1ya/

Behaviour

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Drops file in Program Files directory

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Adds Run entry to start application

NanoCore

Malware Config

C2 Extraction:

ome2j3bw.3utilities.com:1907

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/