General
-
Target
0b648c58a51cd2b2aade2c08e3126f7c0b26ad41cddea38e6f6e01f6f9b365cd
-
Size
416KB
-
Sample
220521-bktx4scac2
-
MD5
ad7965d57e2b9d44f6b757fa3e9faea1
-
SHA1
c90498350b116f34239449f598e105b9a0264bed
-
SHA256
0b648c58a51cd2b2aade2c08e3126f7c0b26ad41cddea38e6f6e01f6f9b365cd
-
SHA512
f1cc6635d682ff0850b3f3c8590319bc340db2d968f818988b91e7c619f97d43f8767d6badd072582a7aadf9f049250c81ef8108b06c315562bffa5093a736f8
Malware Config
Extracted
nanocore
1.2.2.0
185.244.29.216:4050
ba168218-de93-41e2-8edd-0e2ecd0eaef5
-
activate_away_mode
true
-
backup_connection_host
185.244.29.216
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-02-15T02:06:47.823105836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4050
-
default_group
new face
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ba168218-de93-41e2-8edd-0e2ecd0eaef5
-
mutex_timeout
5000
-
prevent_system_sleep
false
- primary_connection_host
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
PO-8372929.exe
-
Size
687KB
-
MD5
4ae608a1f6ef82031cd80d4dfd0f542b
-
SHA1
e921f50ffc9c67e2bb9d657a0747b96a6e27f851
-
SHA256
766904989084e0264f16fd4aff548ca862836d2f6a4ce72c4d0bf66ff78ec478
-
SHA512
00ba929565a77afc27d0ef847995bf7ae76999c4d5936a2ab1f34ec4d237594b49654a6096f55c6429c857ddbdca57a6671fc6feaa2a3b1ba9ecd7943b89916a
Score10/10-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Checks whether UAC is enabled
-
Suspicious use of SetThreadContext
-