nanocore | aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45

Sharing

Copy URL Twitter E-mail

General

Target
aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45
Size 4.8MB
Sample221108-ftm85shfa4
SHA256 aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45
MD5 c83ed817e35967db1d39856936873607
SHA1 f7274910abca23da3114cdd92c44ee954c6db9c0
SHA512 fff3c11a315581e12bb608810bd7d51c7d8e808444c400d5c5b0a04079ea86f89dedb8d4fc203ed8d45ebd1ce5720992f74c73d612274fec80c8c914b79c3d56
SSDEEP 49152:mVBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFEBAmccVpBnpJndKsJV:m7ZMxpjAeHhtivBDwh1c51OAmlHr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

nigger.ddns.net:54984
127.0.0.1:54984

Mutex

b9bba749-2998-47b3-a139-9dc37691d12e

Attributes

activate_away_mode
false
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-07-13T18:27:47.937844436Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
b9bba749-2998-47b3-a139-9dc37691d12e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
nigger.ddns.net
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Nanocore family
nanocore

File Explorer

aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45

.zip 4.8MB
Fortnite Checker By CrackFreakQ/Fortnite Checker By CrackFreakQ.exe

.exe 218KB
Fortnite Checker By CrackFreakQ/SkinSoft.VisualStyler.dll

.dll 964KB
Fortnite Checker By CrackFreakQ/d3dcompiler_47.dll

.dll 3.5MB
Fortnite Checker By CrackFreakQ/xNet.dll

.dll 116KB

aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45

SHA256 aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45
MD5 c83ed817e35967db1d39856936873607
SHA1 f7274910abca23da3114cdd92c44ee954c6db9c0
SHA512 fff3c11a315581e12bb608810bd7d51c7d8e808444c400d5c5b0a04079ea86f89dedb8d4fc203ed8d45ebd1ce5720992f74c73d612274fec80c8c914b79c3d56
SSDEEP 49152:mVBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFEBAmccVpBnpJndKsJV:m7ZMxpjAeHhtivBDwh1c51OAmlHr
MD5 SHA1 SHA512 SSDEEP

Fortnite Checker By CrackFreakQ/Fortnite Checker By CrackFreakQ.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6c3390a9396a3b7fb5851b9d4f7973988829ba7b19b47d1ff673ff0851be6edc
MD5 7a95b334409d5c2ee3aaaa55fbd73aca
SHA1 12a2103b3cf925e8810a24f706b1d55ba2719eaf
SHA512 091fd5e3f9c993e6a33f619d569878df39a99ec9a001f7c6479b970eb24a8b5b87c6fe16c4d2b69eda2ca1d1b8eeda35b8357049e8498634857b119a75c2dd04
SSDEEP 3072:8zEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HItz5iT05t4Ziu8hBVv4TPcXQZA:8LV6Bta6dtJmakIM5MmGtMMnEcXs7hmr
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

124818

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Fortnite Checker By CrackFreakQ/SkinSoft.VisualStyler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 365ffde7df914840eb21c96f34c39912a4b031e3814b8e902b67acee6dff65a1
MD5 2d84a619d4bd339f860cb48af0c9b6c8
SHA1 05e520126ee1100c98263bfbd5a6ff0ce6ace4f7
SHA512 bd0c5e8b018ae393a5f2b92b4a10b5b674ca466074d18b4f86b12cbe9a6a520a95323146cb8e5226b1698f14efcc63addf0df421677b7f5ba3c8d94dbcb511d0
SSDEEP 12288:XxIFyaWHyXq7VBnpJnqRAjcHFNdotFYsFjrXhmEBFa:XxIFyaWHyXq7VBnpJnqRAwHsJm
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

992418

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Fortnite Checker By CrackFreakQ/d3dcompiler_47.dll

IMPHASH cbcbe69594c41c30b8a6ea834d7da501
SHA256 381ec497d7d40b83616b0e82e15c597d04433acc20e94ebe5611f954b2e5309b
MD5 d808acb53436ca8bf04f88d3b40200cb
SHA1 493344c681a2269bb8c202f020ae0583814d2816
SHA512 86dc1ce2ae6c7a36b2f7d4a18278cec99a9a8743df657b2546ef46f0e8007c94d55354fe765a9c17a2fd5b15f21693691d177407b141be23bcde24635093efb5
SSDEEP 49152:1VBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFE:17ZMxpjAeHhtivBDwh1c51
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

16:8a:33:6a:c9:06:7d:4e:9f:02:23:ce:de:fb:89:5f:67:19:46:7c:50:77:1b:f4:a1:92:a2:be:dd:e8:1f:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

PE Signature issue

Digest

f0:bc:59:1a:f6:63:9b:99:44:7c:d6:8b:24:11:48:df:a1:57:63:29

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:6BF6-2D52-92C1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b9:bc:0f:4e:57:e3:66:65:38:00:00:00:00:00:b9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:78:25:5a:b5:cd:23:c6:5f:95:00:01:00:00:01:78

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:4e:3c:f1:73:f4:dd:53:52:a5:00:00:00:00:01:4e

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 17, 2016 - Feb 17, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

Major OS version

Entry point

2803104

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_onexit __dllonexit strncmp strncpy_s malloc _strnicmp atoi _unlock _lock ??1type_info@@UAE@XZ _initterm _amsg_exit _XcptFilter _callnewh _purecall _isnan __isascii _clearfp _controlfp _strdup _mbstrlen _vsnwprintf strtoul isdigit isxdigit atof strchr setlocale strnlen isalpha isspace wcsncmp wcsncpy_s _wcsicmp memcpy memset fclose bsearch qsort strcat_s strstr _except_handler4_common _snwprintf_s __unDName fread fseek _wfsopen wcstoul _fileno sscanf_s _filelengthi64 towlower _wcsnicmp _wsplitpath_s wcscpy_s wcsncat_s wcsrchr swprintf_s _wmakepath_s time _wcsdup _wgetenv _wfullpath _chsize_s _close _read _write _lseeki64 _get_osfhandle _open_osfhandle wcscat_s ftell _mbscmp _memicmp toupper _atoi64 _errno strtod __CxxFrameHandler3 _strtoui64 ?terminate@@YAXXZ _CxxThrowException modf strrchr tolower _finite _fpclass strcpy_s memcpy_s isalnum getenv free _stricmp sprintf_s _vsnprintf memmove _wsopen _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _ftol2 _ftol2_sse ceil floor

kernel32

LCMapStringW CreateFileA GetModuleFileNameA GetEnvironmentVariableA HeapCreate lstrcmpiA FlushViewOfFile MapViewOfFileEx SetFilePointer InitializeCriticalSectionAndSpinCount ExpandEnvironmentStringsW DeviceIoControl SetFilePointerEx SetEndOfFile GetFileType DeleteFileW GetFileAttributesW SetFileAttributesW SetLastError UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize LocalFree LocalAlloc DisableThreadLibraryCalls MultiByteToWideChar WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection OutputDebugStringA HeapAlloc GetProcessHeap HeapFree WriteFile FreeLibrary VirtualFree VirtualAlloc GetSystemInfo CreateFileW GetLastError GetFileSizeEx ReadFile CloseHandle Sleep TlsAlloc TlsSetValue HeapDestroy TlsGetValue TlsFree GetFullPathNameW GetFullPathNameA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount GetProcAddress LoadLibraryExW

advapi32

RegOpenKeyExW CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegQueryValueExA RegEnumKeyExA RegOpenKeyExA RegQueryValueExW CryptDestroyHash RegCloseKey

rpcrt4

UuidCreate

Fortnite Checker By CrackFreakQ/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ac175b4d44245ee8e7aee9cc36df86925ef903d8516f20a2c51d84e35f23da4
MD5 3df8d87a482efad957d83819adb3020f
SHA1 f5b710581355ac5d0de7a36446b93533232144db
SHA512 da28c34a85a6530b1c558fa11b0e71e70710d719cd8ceaf81f954d1fe3927ec139bee6c5f3135425cc5220905240f1a31d831611c46d18f5d52600b607ea59a6
SSDEEP 3072:NWl4rhAigbJ0c1qnV+xnEd44asVyrVfwN5lTCTh3n3F:NWvigbdqnV+xnEd4zsVyJb
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

125278

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

aa34757404acb227cc93a8c88f31fbf4c803243c495badbd4a18429f2da71c45

Fortnite Checker By CrackFreakQ/Fortnite Checker By CrackFreakQ.exe

mscoree

Fortnite Checker By CrackFreakQ/SkinSoft.VisualStyler.dll

mscoree

Fortnite Checker By CrackFreakQ/d3dcompiler_47.dll

PE Signature issue

PE Signature issue

msvcrt

kernel32

advapi32

rpcrt4

Fortnite Checker By CrackFreakQ/xNet.dll

mscoree