General
-
Target
3c90e9c92915fa01a3d351de6cbe50ad69b8b352db3e194a41fdb8b5dcc69f02
-
Size
374KB
-
Sample
220703-ht6rlahgdn
-
MD5
59c4dbf1026f42704bf86ba24092659a
-
SHA1
8b3e4f51c9a337cf1d8d22b6d7fa01a732ae0f13
-
SHA256
3c90e9c92915fa01a3d351de6cbe50ad69b8b352db3e194a41fdb8b5dcc69f02
-
SHA512
1b99bdae9899f41ecb7f50ea00a95270a951c6dee4207a1362a7162fb2482d45cb7d015f22e7a3038882bcdd44cde291312341227eb06fb2c5f8f48a98d10858
Static task
static1
Behavioral task
behavioral1
Sample
3c90e9c92915fa01a3d351de6cbe50ad69b8b352db3e194a41fdb8b5dcc69f02.exe
Resource
win7-20220414-en
Malware Config
Extracted
nanocore
1.2.2.0
safer.ddns.net:2008
2f6b3097-253d-4d67-9581-6e6bc1b70577
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-05-13T13:40:04.752652736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
2008
-
default_group
MOOD
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
2f6b3097-253d-4d67-9581-6e6bc1b70577
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
safer.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
3c90e9c92915fa01a3d351de6cbe50ad69b8b352db3e194a41fdb8b5dcc69f02
-
Size
374KB
-
MD5
59c4dbf1026f42704bf86ba24092659a
-
SHA1
8b3e4f51c9a337cf1d8d22b6d7fa01a732ae0f13
-
SHA256
3c90e9c92915fa01a3d351de6cbe50ad69b8b352db3e194a41fdb8b5dcc69f02
-
SHA512
1b99bdae9899f41ecb7f50ea00a95270a951c6dee4207a1362a7162fb2482d45cb7d015f22e7a3038882bcdd44cde291312341227eb06fb2c5f8f48a98d10858
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-