General
-
Target
3f1dbb250bea98d029c4461945c521ae2f346aab89f9332af05786f7ec60e0be
-
Size
290KB
-
Sample
220521-pcaq6aabhr
-
MD5
7819782e2a31f45a67b6f8d8cc4c3a04
-
SHA1
a1c25d196728d9f7dfe1e1c27d822e0e058b71a7
-
SHA256
3f1dbb250bea98d029c4461945c521ae2f346aab89f9332af05786f7ec60e0be
-
SHA512
875de23e0be73446c01dd40a37d1978ddd2a1f13cb6b23bfab1822ae76ed7f703cd8dd13e74687730c5057c41b4de15dd2c15e05a16e6fba7e6629bc49e3668c
Malware Config
Extracted
nanocore
1.2.2.0
79.134.225.95:8585
c0952507-462f-4ce6-ae9c-ce8bb06f4a77
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-02-29T05:21:55.732548136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8585
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c0952507-462f-4ce6-ae9c-ce8bb06f4a77
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
79.134.225.95
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
Quotation_AxFlow_z.07622562.exe
-
Size
330KB
-
MD5
d2282165d0347879d28f1e5c928bc606
-
SHA1
f2aebf69802415775b65c1f5e6bb18f202e125f7
-
SHA256
5dd4b4e5c60eef42542078f752201788a7a0889b7e494551ef20a8f537295e63
-
SHA512
f6cb71cca6ebed02528e2dfba77aaa366d9951e157271658e74447448cb933b7518c110a825f30d5f2dbcb782e2c568e1e9d7c8103a5fad01c25e237903ce55f
Score10/10-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Suspicious use of SetThreadContext
-