nanocore | bbb59e14d1fb95dd6c24c4eab63500523ae140ccf4bacf990cbc242e72dd3522 | Triage

Sharing

General

Target

bbb59e14d1fb95dd6c24c4eab63500523ae140ccf4bacf990cbc242e72dd3522
Size

167KB
Sample

221123-ln87babh42
MD5

65f004e2eb6bb5ebfb655c9ba721d9ac
SHA1

f229d7c93b89d9d0c5417e1ea475eb77200543fa
SHA256

bbb59e14d1fb95dd6c24c4eab63500523ae140ccf4bacf990cbc242e72dd3522
SHA512

cb10ea09695c6e4685791fc0d3074f9765bc769e3a9b54047e2cc548450e31de7f7ee1d7fac5849a34d4ba0e674dfe4fa2315e1138e89c3ff81a92cd257bd987
SSDEEP

3072:55Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdV6oEB+eqohr6tgyoWDscN4bL71gy:5M80mniiLU7QPersB7qIrIRoesvbPN

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  bbb59e14d1fb95dd6c24c4eab63500523ae140ccf4bacf990cbc242e72dd3522
- Size
  
  167KB
- MD5
  
  65f004e2eb6bb5ebfb655c9ba721d9ac
- SHA1
  
  f229d7c93b89d9d0c5417e1ea475eb77200543fa
- SHA256
  
  bbb59e14d1fb95dd6c24c4eab63500523ae140ccf4bacf990cbc242e72dd3522
- SHA512
  
  cb10ea09695c6e4685791fc0d3074f9765bc769e3a9b54047e2cc548450e31de7f7ee1d7fac5849a34d4ba0e674dfe4fa2315e1138e89c3ff81a92cd257bd987
- SSDEEP
  
  3072:55Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdV6oEB+eqohr6tgyoWDscN4bL71gy:5M80mniiLU7QPersB7qIrIRoesvbPN
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan