General
-
Target
fee0a975f5c3648e0932f4a4004542c4793f4bdac2a3b11d3c4eeb6338dcc68a
-
Size
307KB
-
Sample
220521-pqcsnsfge8
-
MD5
0517ed775838f154690dfce500221f37
-
SHA1
fb1317be1a18daced058474e31748a69705fc872
-
SHA256
fee0a975f5c3648e0932f4a4004542c4793f4bdac2a3b11d3c4eeb6338dcc68a
-
SHA512
9489da595f9ba2f9fe52c227a2987a1b69f5c200aca76a5e0659f6bc8f3eff8c15317aa3fb42c6be7bb64196112353b03b4dd1179930e38b5234a5c456e9b3e1
Static task
static1
Behavioral task
behavioral1
Sample
PROOF OF PAYMENTS.exe
Resource
win7-20220414-en
Malware Config
Extracted
nanocore
1.2.2.0
nansedd.duckdns.org:2133
8a218e14-a254-4eb4-9877-54145473a0a1
-
activate_away_mode
true
-
backup_connection_host
nansedd.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-17T09:36:09.474374836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2133
-
default_group
BACK ON
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
8a218e14-a254-4eb4-9877-54145473a0a1
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
nansedd.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
PROOF OF PAYMENTS.exe
-
Size
400KB
-
MD5
6fe50a531deded71af1475baa734000f
-
SHA1
306f85e89241b6ee2fe694cb429b5afedf7a2f1c
-
SHA256
99e8759e702f1bec43e3646d6c217523a4062918226541899ba710f37c51a12c
-
SHA512
7867169981aa43d1afa21552a6fe775d334759872cf892cb4d251e8131c4edb399739f5ed4163201d0b09d07907d5e6d53406f64051cc9c6fdb048ba4d77163a
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-