General
-
Target
b3589d00282f83e8d833d95b8d7225e73447a530a1a282b7b33583427d08f5b1
-
Size
401KB
-
Sample
220521-cq2etaech7
-
MD5
7fbb8ce5dd01d2737a2e4333182d054c
-
SHA1
3ac88cdc010037d57fa972954bce4ab2755a51da
-
SHA256
b3589d00282f83e8d833d95b8d7225e73447a530a1a282b7b33583427d08f5b1
-
SHA512
d16783b3977824a1e574f5462b1e89a509f7cf5ce42b20e5b98972df1726548f31dfcef7813fad5e8e7f357fe1a4630ecc799038b6d01531592bcdb083aff5ea
Static task
static1
Behavioral task
behavioral1
Sample
RFQ - sample & specification_#R2100131410.exe
Resource
win7-20220414-en
Malware Config
Extracted
nanocore
1.2.2.0
billion1920.duckdns.org:56372
91.192.100.25:56372
aa99d9f5-5722-4e07-9fc2-f779c77bfa3a
-
activate_away_mode
true
-
backup_connection_host
91.192.100.25
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-08T16:56:13.298869536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
56372
-
default_group
7/27 1billion
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
aa99d9f5-5722-4e07-9fc2-f779c77bfa3a
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
billion1920.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
RFQ - sample & specification_#R2100131410.exe
-
Size
510KB
-
MD5
ad0044dc21c79a4ff11f069ddc41dce7
-
SHA1
c09ddf327210cfcdd1a3d5d39fd36dfdf79d9b56
-
SHA256
80f6bea4ffb5f80f64b9b23b96e6ba3e3d7d5eaf1bc8bf3ea1966a6d4469c648
-
SHA512
cc94a200fba1c8aa36cff686e40138e7753fe1b9331f0085362e48a93bb807fccc1d00fe3ab7a3143abafa8b53d8645f903d2baa8da9a2c6992b09f47c41018c
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-