General
-
Target
MAJSUKDOLR-COPY.exe
-
Size
500.0MB
-
Sample
220909-yn88jacgcm
-
MD5
65401fd8ceadff6d78f5484255fa1b35
-
SHA1
df03cee3ff44dbef34f470aeb5118195c731324c
-
SHA256
45c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
-
SHA512
3b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
SSDEEP
6144:zzR0netQObEM9xDoHUfz/Wm071uBuS+E7nH/v9xuEcPvZBvYZE:zzRceDbtWAz/W5aL/v9wEW
Static task
static1
Behavioral task
behavioral1
Sample
MAJSUKDOLR-COPY.exe
Resource
win7-20220812-en
Malware Config
Extracted
nanocore
1.2.2.0
nano8100.duckdns.org:8100
ea2df3dd-6f75-4cfc-bf5b-706727f74cdd
-
activate_away_mode
true
-
backup_connection_host
nano8100.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-02-15T20:53:01.763064736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8100
-
default_group
may 8100
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ea2df3dd-6f75-4cfc-bf5b-706727f74cdd
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
nano8100.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
MAJSUKDOLR-COPY.exe
-
Size
500.0MB
-
MD5
65401fd8ceadff6d78f5484255fa1b35
-
SHA1
df03cee3ff44dbef34f470aeb5118195c731324c
-
SHA256
45c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
-
SHA512
3b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
SSDEEP
6144:zzR0netQObEM9xDoHUfz/Wm071uBuS+E7nH/v9xuEcPvZBvYZE:zzRceDbtWAz/W5aL/v9wEW
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-