YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 6e465858544cd155d68ccb644a3d2fdabba30e04933fa346b5a29beae97dc696.

Scan Results

SHA256 hash: 6e465858544cd155d68ccb644a3d2fdabba30e04933fa346b5a29beae97dc696
File size:2'237'784 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 6279ecd55e6f9c50149c2498a71011e6
SHA1 hash: 447aa0265d8aa9daf8a2ba7722990e2dbc12cba9
SHA3-384 hash: 43d0f1393d9e5f94f81e1c6e6b87fd3dbe2e8391679b4ed688737a7a4c16ab11e0f8cefb16102685716475f36ea75637
First seen:2022-11-24 19:43:06 UTC
Last seen:Never
Sightings:1
imphash : dae02f32a21e03ce65412f6e56942daa
Create hunting rule
ssdeep : 49152:+Qz4rLuoQz4rLuoQz4rLuYQz4rLu1Qz4rLuxLoSUIbLoSUIaAFchAFchAFcUA:+c8LLc8LLc8Llc8LKc8LqoPIvoPIaAFa
TLSH : T185A50222A798853FE2DE967A712656138379C2D39CD3F7DF28D4A1A35A163F406132C3
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:379b8b5a-6c30-11ed-a71a-42010aa4000b
File name:5502aa8.dll
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Dropper.Nancrat-9869495-0
Create hunting rule
Signature:Win.Dropper.Nanocore-9916514-0
Create hunting rule
Signature:Win.Packed.Generic-9777790-0
Create hunting rule
Signature:Win.Trojan.Generic-9783914-0
Create hunting rule
Signature:Win.Trojan.Nanocore-5
Create hunting rule
Signature:Win.Trojan.NanoCore-9852758-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
TLP:TLP:WHITE
Repository:Sandnet
Rule name:malware_Nanocore_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
TLP:TLP:WHITE
Repository:JPCERTCC
Rule name:MALWARE_Win_NanoCore
Create hunting rule
Author:ditekSHen
Description:Detects NanoCore
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
TLP:TLP:WHITE
Repository:jeFF0Falltrades
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:Nanocore_RAT_Gen_2_RID2D96
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
TLP:TLP:WHITE
Rule name:win_nanocore_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
TLP:TLP:WHITE
Repository:Malpedia
Rule name:Windows_Trojan_Nanocore_d8c4e3c5
Create hunting rule
Author:Elastic Security
TLP:TLP:WHITE
Repository:elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.