YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 49797fba25ad52fee285b8130f9cc5b2ad5367898f085838eb3820c136e6de48.

Scan Results

SHA256 hash:	49797fba25ad52fee285b8130f9cc5b2ad5367898f085838eb3820c136e6de48
File size:	229'320 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	0a8fe9ed99c8d5f159c548665cf64fcb
SHA1 hash:	9e78ed669f7b830c60952f21abed2ce994d7dd33
SHA3-384 hash:	d4a892d1fa320917dd211639d077d3bb54dcef924a5b40b7c16d5b96cba4c9980a8c9f2c7649a16cdb4cbc1834d998ff
First seen:	2025-11-20 23:48:50 UTC
Last seen:	Never
Sightings:	1
imphash :	f34d5f2d4577ed6d9ceec516c1f5a744 Create hunting rule
ssdeep :	3072:SzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIt6E9teJPqnXjTA9LWTbg9H:SLV6Bta6dtJmakIM5VETe5qnXjct2E1
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	76a10019-c66b-11f0-adeb-42010aa4000b
File name:	0a8fe9ed99c8d5f159c548665cf64fcb
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Dropper.Nancrat-9869495-0 Create hunting rule

Signature:	Win.Dropper.Nanocore-9916514-0 Create hunting rule

Signature:	Win.Packed.Generic-9777790-0 Create hunting rule

Signature:	Win.Trojan.Generic-9783914-0 Create hunting rule

Signature:	Win.Trojan.Nanocore-5 Create hunting rule

Signature:	Win.Trojan.NanoCore-9852758-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	malware_Nanocore_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MALWARE_Win_NanoCore Create hunting rule
Author:	ditekSHen
Description:	Detects NanoCore
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	nanocore_rat Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore_RAT_Feb18_1_RID2DF1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T
TLP:	TLP:WHITE

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore_RAT_Gen_2_RID2D96 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:	TLP:WHITE

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	pe_imphash Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	win_nanocore_w0 Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	Windows_Trojan_Nanocore_d8c4e3c5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.