Overview

overview

10

Static

static

DHL Accoun...51.exe

windows7-x64

10

DHL Accoun...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Account Overdue Letter - 1301755651.exe

  • Size

    842KB

  • Sample

    221024-pl2agagfem

  • MD5

    664d5c829d9c66ff4922a5d39d03deca

  • SHA1

    2687185bd88b713d91ee11eccad22a44389b7e06

  • SHA256

    2f5f53f6f21e302f248f3684a76fd3622c8942ba1c8c23238d14fd0ea540e256

  • SHA512

    3f52dc198d091cb09ff4e899f5ba53efeaae09f39e7d0e319ddacbb5cd7a71eb918a3583eca6c706d0d68e7f0205fd97f15569ac4e18f325d364302e98d1d87b

  • SSDEEP

    12288:1B7pubXBkdJjNM3oubhaIV7sHPm7DxkVgvsiDymOEIdcN7e:1BCGddsoubRsHPmRkGlD4mNq

Score
10/10
nanocoreevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

198.50.231.134:5498

Mutex

9b971056-14d1-4d11-993c-89c2085bbd7c

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2022-07-01T11:22:25.531243736Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    true

  • connect_delay

    4000

  • connection_port

    5498

  • default_group

    miracle

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    9b971056-14d1-4d11-993c-89c2085bbd7c

  • mutex_timeout

    5000

  • prevent_system_sleep

    true

  • primary_connection_host

    198.50.231.134

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      DHL Account Overdue Letter - 1301755651.exe

    • Size

      842KB

    • MD5

      664d5c829d9c66ff4922a5d39d03deca

    • SHA1

      2687185bd88b713d91ee11eccad22a44389b7e06

    • SHA256

      2f5f53f6f21e302f248f3684a76fd3622c8942ba1c8c23238d14fd0ea540e256

    • SHA512

      3f52dc198d091cb09ff4e899f5ba53efeaae09f39e7d0e319ddacbb5cd7a71eb918a3583eca6c706d0d68e7f0205fd97f15569ac4e18f325d364302e98d1d87b

    • SSDEEP

      12288:1B7pubXBkdJjNM3oubhaIV7sHPm7DxkVgvsiDymOEIdcN7e:1BCGddsoubRsHPmRkGlD4mNq

    Score
    10/10
    nanocoreevasionkeyloggerspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks