nanocore | b22a3facd3066701d920a131edc9458c01a19148e4cacc4176b87c951609d122 | Triage

Sharing

General

Target

b22a3facd3066701d920a131edc9458c01a19148e4cacc4176b87c951609d122
Size

191KB
Sample

221123-ln9svafc7z
MD5

a5bf5d304e8d48fa9e200e1aadbc82e9
SHA1

2b8fdf9e1438b45a3d49eef23733d64711372168
SHA256

b22a3facd3066701d920a131edc9458c01a19148e4cacc4176b87c951609d122
SHA512

ecf40385562cdec69dd340214b1552608c3341b1c090bb5b7bdfd9d44fb3ceab9d7b978fbb56c4a8624320fb8ab0718d0b23c405315389996e981b69b4c21a1d
SSDEEP

3072:H5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdVBdaPRHxevWkXyxgCvPUHOREG:HM80mniiLU7QPeruRH4W8yKCkHOREG

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  b22a3facd3066701d920a131edc9458c01a19148e4cacc4176b87c951609d122
- Size
  
  191KB
- MD5
  
  a5bf5d304e8d48fa9e200e1aadbc82e9
- SHA1
  
  2b8fdf9e1438b45a3d49eef23733d64711372168
- SHA256
  
  b22a3facd3066701d920a131edc9458c01a19148e4cacc4176b87c951609d122
- SHA512
  
  ecf40385562cdec69dd340214b1552608c3341b1c090bb5b7bdfd9d44fb3ceab9d7b978fbb56c4a8624320fb8ab0718d0b23c405315389996e981b69b4c21a1d
- SSDEEP
  
  3072:H5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdVBdaPRHxevWkXyxgCvPUHOREG:HM80mniiLU7QPeruRH4W8yKCkHOREG
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan