General
-
Target
New PO 64739 (UK).exe
-
Size
915KB
-
Sample
201126-ydcv36zt5s
-
MD5
b6babb0d3661cd172c93c496dc4c1db1
-
SHA1
de2db850207d77611f557a060681f2c2a19ae1ef
-
SHA256
bca89f6ecbf4dfde0cc003b96f907ae1ab9b33a64650836d547d07291a059e86
-
SHA512
45dce5171772db72bf71fc72dab6feda73995e7009f6b0bb74b2f25d6a5e23284c06c167505d56c79c6334a6e14e2b44b3117a4207f4396d4f71f01b1381ce91
Static task
static1
Behavioral task
behavioral1
Sample
New PO 64739 (UK).exe
Resource
win7v20201028
Malware Config
Extracted
nanocore
1.2.2.0
185.140.53.207:2121
annapro.linkpc.net.:2121
34118051-8385-43c4-bed1-aa9e16db604f
-
activate_away_mode
true
-
backup_connection_host
annapro.linkpc.net.
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-08-14T02:17:37.803675836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
2121
-
default_group
hip
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
34118051-8385-43c4-bed1-aa9e16db604f
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.140.53.207
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
New PO 64739 (UK).exe
-
Size
915KB
-
MD5
b6babb0d3661cd172c93c496dc4c1db1
-
SHA1
de2db850207d77611f557a060681f2c2a19ae1ef
-
SHA256
bca89f6ecbf4dfde0cc003b96f907ae1ab9b33a64650836d547d07291a059e86
-
SHA512
45dce5171772db72bf71fc72dab6feda73995e7009f6b0bb74b2f25d6a5e23284c06c167505d56c79c6334a6e14e2b44b3117a4207f4396d4f71f01b1381ce91
-
Suspicious use of SetThreadContext
-