Play interactive tour

Edit tour

Analysis Report BFSV-1F(N)_1B-8B_ANSI.exe

Overview

General Information

Sample Name:	BFSV-1F(N)_1B-8B_ANSI.exe
Analysis ID:	336687
MD5:	157d3320cafb9799ed5d996692e8bea7
SHA1:	b8dc9d3720b84695bc18a4310a5f34e2603fc829
SHA256:	5b474ca6fc8158bd6f14d53bca8962f25db3392dfe324f49ddf376610bd785e4
Tags:	exeNanoCoreRAT
Most interesting Screenshot:

Detection

Nanocore

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected Nanocore Rat

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Nanocore RAT

Machine Learning detection for sample

Antivirus or Machine Learning detection for unpacked file

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 5812 cmdline: 'C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe' MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 6560 cmdline: 'C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe' MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 5748 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 5728 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 4544 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 2228 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 6592 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 6584 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 4944 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 6980 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 6648 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 6884 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 6644 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 7140 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

BFSV-1F(N)_1B-8B_ANSI.exe (PID: 7100 cmdline: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe MD5: 157D3320CAFB9799ED5D996692E8BEA7)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x47690:$x1: NanoCore.ClientPluginHost 0x476f1:$x2: IClientNetworkHost 0x4caf6:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x5aa68:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x47195:$a: NanoCore 0x471b1:$a: NanoCore 0x4730c:$a: NanoCore 0x4731b:$a: NanoCore 0x475f4:$a: NanoCore 0x47620:$a: NanoCore 0x47690:$a: NanoCore 0x570d2:$a: NanoCore 0x570e4:$a: NanoCore 0x57120:$a: NanoCore 0x4723c:$b: ClientPlugin 0x47365:$b: ClientPlugin 0x47629:$b: ClientPlugin 0x47699:$b: ClientPlugin 0x570ed:$b: ClientPlugin 0x57129:$b: ClientPlugin 0x474b2:$c: ProjectData 0x5701f:$c: ProjectData 0x485ee:$d: DESCrypto 0x5797d:$d: DESCrypto 0x5297b:$e: KeepAlive
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x117618:$x1: NanoCore.ClientPluginHost 0x117679:$x2: IClientNetworkHost 0x11ca7e:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x12a9f0:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x11711d:$a: NanoCore 0x117139:$a: NanoCore 0x117294:$a: NanoCore 0x1172a3:$a: NanoCore 0x11757c:$a: NanoCore 0x1175a8:$a: NanoCore 0x117618:$a: NanoCore 0x12705a:$a: NanoCore 0x12706c:$a: NanoCore 0x1270a8:$a: NanoCore 0x1171c4:$b: ClientPlugin 0x1172ed:$b: ClientPlugin 0x1175b1:$b: ClientPlugin 0x117621:$b: ClientPlugin 0x127075:$b: ClientPlugin 0x1270b1:$b: ClientPlugin 0x11743a:$c: ProjectData 0x126fa7:$c: ProjectData 0x118576:$d: DESCrypto 0x127905:$d: DESCrypto 0x122903:$e: KeepAlive
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8d53b:$x1: NanoCore.ClientPluginHost 0x8d59c:$x2: IClientNetworkHost 0x929a1:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xa0913:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8d040:$a: NanoCore 0x8d05c:$a: NanoCore 0x8d1b7:$a: NanoCore 0x8d1c6:$a: NanoCore 0x8d49f:$a: NanoCore 0x8d4cb:$a: NanoCore 0x8d53b:$a: NanoCore 0x9cf7d:$a: NanoCore 0x9cf8f:$a: NanoCore 0x9cfcb:$a: NanoCore 0x8d0e7:$b: ClientPlugin 0x8d210:$b: ClientPlugin 0x8d4d4:$b: ClientPlugin 0x8d544:$b: ClientPlugin 0x9cf98:$b: ClientPlugin 0x9cfd4:$b: ClientPlugin 0x8d35d:$c: ProjectData 0x9ceca:$c: ProjectData 0x8e499:$d: DESCrypto 0x9d828:$d: DESCrypto 0x98826:$e: KeepAlive
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x145019:$x1: NanoCore.ClientPluginHost 0x14507a:$x2: IClientNetworkHost 0x14a47f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1583f1:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x144b1e:$a: NanoCore 0x144b3a:$a: NanoCore 0x144c95:$a: NanoCore 0x144ca4:$a: NanoCore 0x144f7d:$a: NanoCore 0x144fa9:$a: NanoCore 0x145019:$a: NanoCore 0x154a5b:$a: NanoCore 0x154a6d:$a: NanoCore 0x154aa9:$a: NanoCore 0x144bc5:$b: ClientPlugin 0x144cee:$b: ClientPlugin 0x144fb2:$b: ClientPlugin 0x145022:$b: ClientPlugin 0x154a76:$b: ClientPlugin 0x154ab2:$b: ClientPlugin 0x144e3b:$c: ProjectData 0x1549a8:$c: ProjectData 0x145f77:$d: DESCrypto 0x155306:$d: DESCrypto 0x150304:$e: KeepAlive
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xcc0b0:$x1: NanoCore.ClientPluginHost 0xcc111:$x2: IClientNetworkHost 0xd1516:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xdf488:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xcbbb5:$a: NanoCore 0xcbbd1:$a: NanoCore 0xcbd2c:$a: NanoCore 0xcbd3b:$a: NanoCore 0xcc014:$a: NanoCore 0xcc040:$a: NanoCore 0xcc0b0:$a: NanoCore 0xdbaf2:$a: NanoCore 0xdbb04:$a: NanoCore 0xdbb40:$a: NanoCore 0xcbc5c:$b: ClientPlugin 0xcbd85:$b: ClientPlugin 0xcc049:$b: ClientPlugin 0xcc0b9:$b: ClientPlugin 0xdbb0d:$b: ClientPlugin 0xdbb49:$b: ClientPlugin 0xcbed2:$c: ProjectData 0xdba3f:$c: ProjectData 0xcd00e:$d: DESCrypto 0xdc39d:$d: DESCrypto 0xd739b:$e: KeepAlive
Click to see the 38 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1d9e5:$x1: NanoCore.ClientPluginHost 0x1da22:$x2: IClientNetworkHost 0x21555:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1d75d:$x1: NanoCore Client.exe 0x1d9e5:$x2: NanoCore.ClientPluginHost 0x1f01e:$s1: PluginCommand 0x1f012:$s2: FileCommand 0x1fec3:$s3: PipeExists 0x25c7a:$s4: PipeCreated 0x1da0f:$s5: IClientLoggingHost
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1d74d:$a: NanoCore 0x1d75d:$a: NanoCore 0x1d991:$a: NanoCore 0x1d9a5:$a: NanoCore 0x1d9e5:$a: NanoCore 0x1d7ac:$b: ClientPlugin 0x1d9ae:$b: ClientPlugin 0x1d9ee:$b: ClientPlugin 0x1d8d3:$c: ProjectData 0x1e2da:$d: DESCrypto 0x25ca6:$e: KeepAlive 0x23c94:$g: LogClientMessage 0x1fe8f:$i: get_Connected 0x1e610:$j: #=q 0x1e640:$j: #=q 0x1e65c:$j: #=q 0x1e68c:$j: #=q 0x1e6a8:$j: #=q 0x1e6c4:$j: #=q 0x1e6f4:$j: #=q 0x1e710:$j: #=q
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1d9e5:$x1: NanoCore.ClientPluginHost 0x1da22:$x2: IClientNetworkHost 0x21555:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1d75d:$x1: NanoCore Client.exe 0x1d9e5:$x2: NanoCore.ClientPluginHost 0x1f01e:$s1: PluginCommand 0x1f012:$s2: FileCommand 0x1fec3:$s3: PipeExists 0x25c7a:$s4: PipeCreated 0x1da0f:$s5: IClientLoggingHost
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1d74d:$a: NanoCore 0x1d75d:$a: NanoCore 0x1d991:$a: NanoCore 0x1d9a5:$a: NanoCore 0x1d9e5:$a: NanoCore 0x1d7ac:$b: ClientPlugin 0x1d9ae:$b: ClientPlugin 0x1d9ee:$b: ClientPlugin 0x1d8d3:$c: ProjectData 0x1e2da:$d: DESCrypto 0x25ca6:$e: KeepAlive 0x23c94:$g: LogClientMessage 0x1fe8f:$i: get_Connected 0x1e610:$j: #=q 0x1e640:$j: #=q 0x1e65c:$j: #=q 0x1e68c:$j: #=q 0x1e6a8:$j: #=q 0x1e6c4:$j: #=q 0x1e6f4:$j: #=q 0x1e710:$j: #=q
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1d9e5:$x1: NanoCore.ClientPluginHost 0x1da22:$x2: IClientNetworkHost 0x21555:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1d75d:$x1: NanoCore Client.exe 0x1d9e5:$x2: NanoCore.ClientPluginHost 0x1f01e:$s1: PluginCommand 0x1f012:$s2: FileCommand 0x1fec3:$s3: PipeExists 0x25c7a:$s4: PipeCreated 0x1da0f:$s5: IClientLoggingHost
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1d74d:$a: NanoCore 0x1d75d:$a: NanoCore 0x1d991:$a: NanoCore 0x1d9a5:$a: NanoCore 0x1d9e5:$a: NanoCore 0x1d7ac:$b: ClientPlugin 0x1d9ae:$b: ClientPlugin 0x1d9ee:$b: ClientPlugin 0x1d8d3:$c: ProjectData 0x1e2da:$d: DESCrypto 0x25ca6:$e: KeepAlive 0x23c94:$g: LogClientMessage 0x1fe8f:$i: get_Connected 0x1e610:$j: #=q 0x1e640:$j: #=q 0x1e65c:$j: #=q 0x1e68c:$j: #=q 0x1e6a8:$j: #=q 0x1e6c4:$j: #=q 0x1e6f4:$j: #=q 0x1e710:$j: #=q
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1d9e5:$x1: NanoCore.ClientPluginHost 0x1da22:$x2: IClientNetworkHost 0x21555:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1d75d:$x1: NanoCore Client.exe 0x1d9e5:$x2: NanoCore.ClientPluginHost 0x1f01e:$s1: PluginCommand 0x1f012:$s2: FileCommand 0x1fec3:$s3: PipeExists 0x25c7a:$s4: PipeCreated 0x1da0f:$s5: IClientLoggingHost
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1d74d:$a: NanoCore 0x1d75d:$a: NanoCore 0x1d991:$a: NanoCore 0x1d9a5:$a: NanoCore 0x1d9e5:$a: NanoCore 0x1d7ac:$b: ClientPlugin 0x1d9ae:$b: ClientPlugin 0x1d9ee:$b: ClientPlugin 0x1d8d3:$c: ProjectData 0x1e2da:$d: DESCrypto 0x25ca6:$e: KeepAlive 0x23c94:$g: LogClientMessage 0x1fe8f:$i: get_Connected 0x1e610:$j: #=q 0x1e640:$j: #=q 0x1e65c:$j: #=q 0x1e68c:$j: #=q 0x1e6a8:$j: #=q 0x1e6c4:$j: #=q 0x1e6f4:$j: #=q 0x1e710:$j: #=q
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1d9e5:$x1: NanoCore.ClientPluginHost 0x1da22:$x2: IClientNetworkHost 0x21555:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1d75d:$x1: NanoCore Client.exe 0x1d9e5:$x2: NanoCore.ClientPluginHost 0x1f01e:$s1: PluginCommand 0x1f012:$s2: FileCommand 0x1fec3:$s3: PipeExists 0x25c7a:$s4: PipeCreated 0x1da0f:$s5: IClientLoggingHost
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1d74d:$a: NanoCore 0x1d75d:$a: NanoCore 0x1d991:$a: NanoCore 0x1d9a5:$a: NanoCore 0x1d9e5:$a: NanoCore 0x1d7ac:$b: ClientPlugin 0x1d9ae:$b: ClientPlugin 0x1d9ee:$b: ClientPlugin 0x1d8d3:$c: ProjectData 0x1e2da:$d: DESCrypto 0x25ca6:$e: KeepAlive 0x23c94:$g: LogClientMessage 0x1fe8f:$i: get_Connected 0x1e610:$j: #=q 0x1e640:$j: #=q 0x1e65c:$j: #=q 0x1e68c:$j: #=q 0x1e6a8:$j: #=q 0x1e6c4:$j: #=q 0x1e6f4:$j: #=q 0x1e710:$j: #=q
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1d9e5:$x1: NanoCore.ClientPluginHost 0x1da22:$x2: IClientNetworkHost 0x21555:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1d75d:$x1: NanoCore Client.exe 0x1d9e5:$x2: NanoCore.ClientPluginHost 0x1f01e:$s1: PluginCommand 0x1f012:$s2: FileCommand 0x1fec3:$s3: PipeExists 0x25c7a:$s4: PipeCreated 0x1da0f:$s5: IClientLoggingHost
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1d74d:$a: NanoCore 0x1d75d:$a: NanoCore 0x1d991:$a: NanoCore 0x1d9a5:$a: NanoCore 0x1d9e5:$a: NanoCore 0x1d7ac:$b: ClientPlugin 0x1d9ae:$b: ClientPlugin 0x1d9ee:$b: ClientPlugin 0x1d8d3:$c: ProjectData 0x1e2da:$d: DESCrypto 0x25ca6:$e: KeepAlive 0x23c94:$g: LogClientMessage 0x1fe8f:$i: get_Connected 0x1e610:$j: #=q 0x1e640:$j: #=q 0x1e65c:$j: #=q 0x1e68c:$j: #=q 0x1e6a8:$j: #=q 0x1e6c4:$j: #=q 0x1e6f4:$j: #=q 0x1e710:$j: #=q
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x215e5:$x1: NanoCore.ClientPluginHost 0x21622:$x2: IClientNetworkHost 0x25155:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2135d:$x1: NanoCore Client.exe 0x215e5:$x2: NanoCore.ClientPluginHost 0x22c1e:$s1: PluginCommand 0x22c12:$s2: FileCommand 0x23ac3:$s3: PipeExists 0x2987a:$s4: PipeCreated 0x2160f:$s5: IClientLoggingHost
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2134d:$a: NanoCore 0x2135d:$a: NanoCore 0x21591:$a: NanoCore 0x215a5:$a: NanoCore 0x215e5:$a: NanoCore 0x213ac:$b: ClientPlugin 0x215ae:$b: ClientPlugin 0x215ee:$b: ClientPlugin 0x214d3:$c: ProjectData 0x21eda:$d: DESCrypto 0x298a6:$e: KeepAlive 0x27894:$g: LogClientMessage 0x23a8f:$i: get_Connected 0x22210:$j: #=q 0x22240:$j: #=q 0x2225c:$j: #=q 0x2228c:$j: #=q 0x222a8:$j: #=q 0x222c4:$j: #=q 0x222f4:$j: #=q 0x22310:$j: #=q
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1d9e5:$x1: NanoCore.ClientPluginHost 0x1da22:$x2: IClientNetworkHost 0x21555:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1d75d:$x1: NanoCore Client.exe 0x1d9e5:$x2: NanoCore.ClientPluginHost 0x1f01e:$s1: PluginCommand 0x1f012:$s2: FileCommand 0x1fec3:$s3: PipeExists 0x25c7a:$s4: PipeCreated 0x1da0f:$s5: IClientLoggingHost
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1d74d:$a: NanoCore 0x1d75d:$a: NanoCore 0x1d991:$a: NanoCore 0x1d9a5:$a: NanoCore 0x1d9e5:$a: NanoCore 0x1d7ac:$b: ClientPlugin 0x1d9ae:$b: ClientPlugin 0x1d9ee:$b: ClientPlugin 0x1d8d3:$c: ProjectData 0x1e2da:$d: DESCrypto 0x25ca6:$e: KeepAlive 0x23c94:$g: LogClientMessage 0x1fe8f:$i: get_Connected 0x1e610:$j: #=q 0x1e640:$j: #=q 0x1e65c:$j: #=q 0x1e68c:$j: #=q 0x1e6a8:$j: #=q 0x1e6c4:$j: #=q 0x1e6f4:$j: #=q 0x1e710:$j: #=q
Click to see the 51 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: BFSV-1F(N)_1B-8B_ANSI.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: BFSV-1F(N)_1B-8B_ANSI.exe

ReversingLabs: Detection: 43%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592, type: MEMORY
Source: Yara match	File source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: BFSV-1F(N)_1B-8B_ANSI.exe

Joe Sandbox ML: detected

Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.c90000.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 6.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 7.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 10.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 4.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 5.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 16.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 17.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.2910000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 5.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.14c0000.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 12.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 13.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.d60000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.d60000.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.2c40000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 16.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 9.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 12.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 9.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 1.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 7.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 17.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 3.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 1.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	Avira: Label: TR/Dropper.Gen

Source: BFSV-1F(N)_1B-8B_ANSI.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: BFSV-1F(N)_1B-8B_ANSI.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000000.00000003.656376001.0000000002980000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000002.00000003.661875522.0000000002CD0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000004.00000003.667666790.0000000002ED0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000006.00000003.673425665.00000000030D0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000008.00000003.678621047.0000000002A50000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 0000000A.00000003.687772999.0000000002560000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000003.695772930.0000000002810000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000000.00000003.656376001.0000000002980000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000002.00000003.661875522.0000000002CD0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000004.00000003.667666790.0000000002ED0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000006.00000003.673425665.00000000030D0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000008.00000003.678621047.0000000002A50000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 0000000A.00000003.687772999.0000000002560000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000003.695772930.0000000002810000.00000004.00000001.sdmp

Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000000.00000002.658811495.0000000000E0A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592, type: MEMORY
Source: Yara match	File source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 0_2_003ED580
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 1_2_003ED580

Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000000.00000003.656792236.0000000002C2F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BFSV-1F(N)_1B-8B_ANSI.exe
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000002.00000003.662135152.0000000002F7F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BFSV-1F(N)_1B-8B_ANSI.exe
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000004.00000003.667765526.0000000002FEF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BFSV-1F(N)_1B-8B_ANSI.exe
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000006.00000003.673368529.000000000337F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BFSV-1F(N)_1B-8B_ANSI.exe
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000008.00000003.678962378.00000000029D6000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BFSV-1F(N)_1B-8B_ANSI.exe
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 0000000A.00000003.688343785.000000000280F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BFSV-1F(N)_1B-8B_ANSI.exe
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000003.695713586.0000000002796000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs BFSV-1F(N)_1B-8B_ANSI.exe

Source: BFSV-1F(N)_1B-8B_ANSI.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: classification engine

Classification label: mal84.troj.winEXE@29/0@0/0

Source: BFSV-1F(N)_1B-8B_ANSI.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: BFSV-1F(N)_1B-8B_ANSI.exe

ReversingLabs: Detection: 43%

Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe

File read: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe 'C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe'
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe 'C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe'
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: unknown	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe 'C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe'
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe

Source: BFSV-1F(N)_1B-8B_ANSI.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000000.00000003.656376001.0000000002980000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000002.00000003.661875522.0000000002CD0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000004.00000003.667666790.0000000002ED0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000006.00000003.673425665.00000000030D0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000008.00000003.678621047.0000000002A50000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 0000000A.00000003.687772999.0000000002560000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000003.695772930.0000000002810000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000000.00000003.656376001.0000000002980000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000002.00000003.661875522.0000000002CD0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000004.00000003.667666790.0000000002ED0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000006.00000003.673425665.00000000030D0000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 00000008.00000003.678621047.0000000002A50000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 0000000A.00000003.687772999.0000000002560000.00000004.00000001.sdmp, BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000003.695772930.0000000002810000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 0_2_00405EC0 push eax; ret
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 1_2_00405EC0 push eax; ret

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 0_2_00405CA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 0_2_00B8ECBE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 0_2_00B8F5D4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 0_2_00B8F534 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 0_2_00B8F715 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 0_2_00B8F571 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 1_2_00405CA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 2_2_00F5F87D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 2_2_00F5F8E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 2_2_00F5F840 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 2_2_00F5EFCA mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 2_2_00F5FA21 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 4_2_00DDF9C1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 4_2_00DDEF6A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 4_2_00DDF7E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 4_2_00DDF81D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 4_2_00DDF880 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 6_2_012FF980 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 6_2_012FF91D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 6_2_012FF06A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 6_2_012FF8E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 6_2_012FFAC1 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 8_2_00B3F529 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 8_2_00B3F58C mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 8_2_00B3EC76 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 8_2_00B3F4EC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 8_2_00B3F6CD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 10_2_0054FB54 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 10_2_0054F2DE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 10_2_0054FBF4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 10_2_0054FB91 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 10_2_0054FD35 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 13_2_005DFAD4 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 13_2_005DFA71 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 13_2_005DFC15 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 13_2_005DF1BE mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Code function: 13_2_005DFA34 mov eax, dword ptr fs:[00000030h]

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe 'C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe'
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Source: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe	Process created: C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe

Source: BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000002.1018992662.0000000001270000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000002.1018992662.0000000001270000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000002.1018992662.0000000001270000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 0000000D.00000002.1018992662.0000000001270000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592, type: MEMORY
Source: Yara match	File source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: BFSV-1F(N)_1B-8B_ANSI.exe, 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544, type: MEMORY
Source: Yara match	File source: Process Memory Space: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592, type: MEMORY
Source: Yara match	File source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.BFSV-1F(N)_1B-8B_ANSI.exe.2870000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.BFSV-1F(N)_1B-8B_ANSI.exe.a10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.BFSV-1F(N)_1B-8B_ANSI.exe.1530000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.BFSV-1F(N)_1B-8B_ANSI.exe.2f40000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BFSV-1F(N)_1B-8B_ANSI.exe.d70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.BFSV-1F(N)_1B-8B_ANSI.exe.d00000.2.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Software Packing1	Input Capture1	Process Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	System Information Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Remote Access Software1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
BFSV-1F(N)_1B-8B_ANSI.exe	43%	ReversingLabs	Win32.Trojan.Generic
BFSV-1F(N)_1B-8B_ANSI.exe	100%	Avira	TR/Dropper.Gen
BFSV-1F(N)_1B-8B_ANSI.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.c90000.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
6.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
7.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
2.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
10.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
4.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
5.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
10.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
6.2.BFSV-1F(N)_1B-8B_ANSI.exe.1430000.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
16.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
17.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.2910000.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
5.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
8.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
4.2.BFSV-1F(N)_1B-8B_ANSI.exe.14c0000.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
12.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
13.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
13.2.BFSV-1F(N)_1B-8B_ANSI.exe.d60000.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.d60000.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
2.2.BFSV-1F(N)_1B-8B_ANSI.exe.2c40000.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
8.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
16.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
9.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
12.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
9.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
1.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
7.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
17.2.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
3.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
1.0.BFSV-1F(N)_1B-8B_ANSI.exe.3e0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	336687
Start date:	06.01.2021
Start time:	17:30:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 48s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	BFSV-1F(N)_1B-8B_ANSI.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.winEXE@29/0@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.5209083744680925
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BFSV-1F(N)_1B-8B_ANSI.exe
File size:	451584
MD5:	157d3320cafb9799ed5d996692e8bea7
SHA1:	b8dc9d3720b84695bc18a4310a5f34e2603fc829
SHA256:	5b474ca6fc8158bd6f14d53bca8962f25db3392dfe324f49ddf376610bd785e4
SHA512:	aafe5ef3c4e7f0f24eb41da724b6a518bf18f5226e00e3318a888ab0b69de6724ee3da4fa210080f29f254f6a043ecfaa4753a841a21ef6f3f39c338feed8983
SSDEEP:	12288:aVZsUDYE0ewlQyiKIRhyIAI6vFxxBEEmfVfXeVKl:aV7XGQyjI2IAJxxA52Kl
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&+..bJ..bJ..bJ...=K.nJ..bJ..MJ...U..aJ...V..`J...U..iJ..E.<.cJ..E.;.cJ..E.>.cJ..RichbJ..........PE..L...>t._.................R.

File Icon


Icon Hash:	74f4c4ccccd4d0d4

Static PE Info

General
Entrypoint:	0x425eef
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FF5743E [Wed Jan 6 08:26:38 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	31c815897a3b55d8d8afcee958fa181c

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004270D0h
push 00426070h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00427044h]
pop ecx
or dword ptr [00428054h], FFFFFFFFh
or dword ptr [00428058h], FFFFFFFFh
call dword ptr [00427048h]
mov ecx, dword ptr [00428050h]
mov dword ptr [eax], ecx
call dword ptr [0042704Ch]
mov ecx, dword ptr [0042804Ch]
mov dword ptr [eax], ecx
mov eax, dword ptr [00427050h]
mov eax, dword ptr [eax]
mov dword ptr [0042805Ch], eax
call 00007F8C60F8ED06h
cmp dword ptr [00428030h], ebx
jne 00007F8C60F8EBFEh
push 0042606Ch
call dword ptr [00427054h]
pop ecx
call 00007F8C60F8ECD8h
push 0042800Ch
push 00428008h
call 00007F8C60F8ECC3h
mov eax, dword ptr [00428048h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00428044h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0042705Ch]
push 00428004h
push 00428000h
call 00007F8C60F8EC90h

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[LNK] VS2012 build 50727
[ C ] VS2012 build 50727
[LNK] VS98 (6.0) imp/exp build 8168
[RES] VS2012 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x270dc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x29000	0x4138	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e000	0xa4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x27000	0xd0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x25124	0x25200	False	0.416831071128	data	5.57014558903	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x27000	0x5ac	0x600	False	0.51171875	data	4.78880407178	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x60	0x200	False	0.056640625	data	0.195201267787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x29000	0x4138	0x4200	False	0.816761363636	data	7.55093870165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e000	0x264	0x400	False	0.1689453125	data	1.22391765681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x29100	0x2615	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_RCDATA	0x2b730	0x1a05	data	English	United States
RT_GROUP_ICON	0x2b718	0x14	data	English	United States

Imports

DLL	Import
MSVCRT.dll	_controlfp, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, free, exit, _XcptFilter, _exit, malloc
KERNEL32.dll	GetStartupInfoA, GetModuleHandleA
MSACM32.dll	acmDriverMessage, acmDriverPriority, acmFilterChooseW, acmFilterDetailsA, acmFilterEnumW, acmFormatTagEnumW
mscms.dll	UnregisterCMMA, CloseColorProfile, UninstallColorProfileW, CheckBitmapBits
WINSPOOL.DRV	DeleteMonitorA, EnumMonitorsA, EnumPrintProcessorDatatypesW, PrinterMessageBoxA, ResetPrinterW, GetPrinterA, AddPrinterConnectionW
COMDLG32.dll	GetFileTitleW, ChooseColorW, ReplaceTextA, PageSetupDlgA
SHLWAPI.dll	GetMenuPosFromID, StrCmpNW, StrToIntW, SHQueryValueExA, PathGetDriveNumberA, PathFindNextComponentW, SHRegEnumUSKeyW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5812 Parent PID: 6084

General

Start time:	17:31:25
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe'
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.658023980.0000000000D70000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6560 Parent PID: 5812

General

Start time:	17:31:28
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe'
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748 Parent PID: 5812

General

Start time:	17:31:29
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.664101566.0000000001430000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5728 Parent PID: 5748

General

Start time:	17:31:31
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544 Parent PID: 5748

General

Start time:	17:31:31
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000004.00000002.670372139.0000000001530000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 2228 Parent PID: 4544

General

Start time:	17:31:33
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6592 Parent PID: 4544

General

Start time:	17:31:34
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000002.675497262.0000000002F40000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6584 Parent PID: 6592

General

Start time:	17:31:36
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4944 Parent PID: 6592

General

Start time:	17:31:37
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000008.00000002.686570986.0000000002870000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6980 Parent PID: 4944

General

Start time:	17:31:38
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6648 Parent PID: 4944

General

Start time:	17:31:39
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.691981291.0000000000D00000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6884 Parent PID: 6648

General

Start time:	17:31:43
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6644 Parent PID: 6648

General

Start time:	17:31:44
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000D.00000002.1018854481.0000000000A10000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 7140 Parent PID: 6644

General

Start time:	17:31:46
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x3e0000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 7100 Parent PID: 6644

General

Start time:	17:31:47
Start date:	06/01/2021
Path:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\BFSV-1F(N)_1B-8B_ANSI.exe
Imagebase:	0x360000
File size:	451584 bytes
MD5 hash:	157D3320CAFB9799ED5D996692E8BEA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report BFSV-1F(N)_1B-8B_ANSI.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5812 Parent PID: 6084

General

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 6560 Parent PID: 5812

General

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5748 Parent PID: 5812

General

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 5728 Parent PID: 5748

General

Analysis Process: BFSV-1F(N)_1B-8B_ANSI.exe PID: 4544 Parent PID: 5748