nanocore | ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d | Triage

Sharing

General

Target

ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d
Size

620KB
Sample

220701-f6a5cafga2
MD5

9d61337a7076d907d0a5282003adf16c
SHA1

62a7d89391337e8e52d65efa4d2456e7d28a2cdf
SHA256

ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d
SHA512

674df81e9201dc39d215b1991fda1c9b41cc04a0fb4be307611d3637089e0fe49bceefe9a402ee9155e313a985359eadb461da9f86327773bbf8b0d66cc68f80

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d
- Size
  
  620KB
- MD5
  
  9d61337a7076d907d0a5282003adf16c
- SHA1
  
  62a7d89391337e8e52d65efa4d2456e7d28a2cdf
- SHA256
  
  ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d
- SHA512
  
  674df81e9201dc39d215b1991fda1c9b41cc04a0fb4be307611d3637089e0fe49bceefe9a402ee9155e313a985359eadb461da9f86327773bbf8b0d66cc68f80
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan