nanocore

General

Target
d80beb591e3b51c0098d9b2f12f82236.exe
Size 1.1MB
Sample210406-914kptnyja
SHA256 bf2250c3400a28a3063a4a4489a5fc3e54975d4bd4c97a429de0d3b1699224e9
MD5 d80beb591e3b51c0098d9b2f12f82236
SHA1 88590725366dab6a5ec740869c57316aa02f6eb9
SHA512 4b574ab9a0d4f2da506093e9cfc1f0b22ed10ceb4985e6c73426b5ff93309fb350781f5c41583bb14fb68fc6b56742a5648dd723b7c6094efa753605ad683dd8
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

C2

cato.fingusti.club:6609

Targets

- Target
  d80beb591e3b51c0098d9b2f12f82236.exe
- Size 1.1MB
- SHA256 bf2250c3400a28a3063a4a4489a5fc3e54975d4bd4c97a429de0d3b1699224e9
- MD5 d80beb591e3b51c0098d9b2f12f82236
- SHA1 88590725366dab6a5ec740869c57316aa02f6eb9
- SHA512 4b574ab9a0d4f2da506093e9cfc1f0b22ed10ceb4985e6c73426b5ff93309fb350781f5c41583bb14fb68fc6b56742a5648dd723b7c6094efa753605ad683dd8
- MD5 SHA1 SHA512
Score

10^/10

nanocore remcos keylogger persistence rat spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Remcos

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2