General

  • Target

    3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc

  • Size

    180KB

  • Sample

    220921-gfsgdafch8

  • MD5

    d68c1898ceffa72ba1ac579c83cc494c

  • SHA1

    0cbea644e19ae6d3b934a648b5bd1a9558c64e96

  • SHA256

    3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc

  • SHA512

    35b09232dd1abb7d23910e64d09e6bebd43bc2469c6e4d44a2a4ed8fd88051ec0d08206a8fce25f1efb5aa85cefb9a8d87ddf9adb026029894c5481a19bb1b43

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

95.70.139.81:54984

Attributes
activate_away_mode
false
backup_connection_host
95.70.139.81
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-07-01T08:20:47.457547136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
2afd92d3-82ee-48f4-9de3-98029fbb1ca4
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
95.70.139.81
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

    • Target

      3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc

    • Size

      180KB

    • MD5

      d68c1898ceffa72ba1ac579c83cc494c

    • SHA1

      0cbea644e19ae6d3b934a648b5bd1a9558c64e96

    • SHA256

      3d9862ee74e3315354f5423cb0617d65b1a6793821377f3380e6f4a5962598dc

    • SHA512

      35b09232dd1abb7d23910e64d09e6bebd43bc2469c6e4d44a2a4ed8fd88051ec0d08206a8fce25f1efb5aa85cefb9a8d87ddf9adb026029894c5481a19bb1b43

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation