General
-
Target
f68a1bb0e7aae64762f26fb29f6490d00595a13701058216bcbbc2333560ebd3
-
Size
439KB
-
Sample
220520-3jzkrahac7
-
MD5
cbe11e10e61b248c79979de8e1da3a2f
-
SHA1
09b23f9017cf610c73ac09f983945ef0f85881e3
-
SHA256
f68a1bb0e7aae64762f26fb29f6490d00595a13701058216bcbbc2333560ebd3
-
SHA512
9c46fec0614d55305c80daaaf8a51a94d124b508c52d270b8d1c9bac35d0484b532611f42e5c98a0e1eeffec06a7ae75ad3c7727b276bea2bb865d9579453662
Static task
static1
Behavioral task
behavioral1
Sample
xR8dE8xl0Wg9YDb.exe
Resource
win7-20220414-en
Malware Config
Extracted
nanocore
1.2.2.0
185.165.153.201:1985
127.0.0.1:1985
30744d43-8939-4e7f-9084-5db4339c4c8f
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-16T01:24:47.907078236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1985
-
default_group
Cherry
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
30744d43-8939-4e7f-9084-5db4339c4c8f
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.165.153.201
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
xR8dE8xl0Wg9YDb.exe
-
Size
568KB
-
MD5
de47440e504d0e9a01b74434a7eb6781
-
SHA1
a0d85f84ea0334d03621a103d489b303346edd36
-
SHA256
f54d80f92e33206cfbd4e81d76081f73385fc13513ba1a61805063b121dbddee
-
SHA512
edd648794719a49ba6093ba0fb249319fea443f72a61ad2968d63f30074c37989ea28bf65a46cc9465d3a80c8eeb706f7a679f10dc750d017a8d0071d7069b58
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-