nanocore | 9f57f29bc1da6b84255a1164c0394834713dd073a6b01f06b4bc2b6ebab0b96f | Triage

Sharing

General

Target

9f57f29bc1da6b84255a1164c0394834713dd073a6b01f06b4bc2b6ebab0b96f
Size

181KB
Sample

221123-lpbbnsbh43
MD5

670737a1a716f375f343b6c2b1dc8fde
SHA1

76f03fc406a605ff106d5c39cdbf2179da1412da
SHA256

9f57f29bc1da6b84255a1164c0394834713dd073a6b01f06b4bc2b6ebab0b96f
SHA512

603b8fd0f3463a7106b6a6817b44d8275bbe4edaf1b4d58a7a085ed1e534d7ec5962ae440b736dbb5a82c1c8cb20f369a4c7b15580425c6eca4e18c44e7a9e9c
SSDEEP

3072:f5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdVPe/vGC5iIO/Sl1BhI3QoD:fM80mniiLU7QPerPavj7k41PI3QoD

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  9f57f29bc1da6b84255a1164c0394834713dd073a6b01f06b4bc2b6ebab0b96f
- Size
  
  181KB
- MD5
  
  670737a1a716f375f343b6c2b1dc8fde
- SHA1
  
  76f03fc406a605ff106d5c39cdbf2179da1412da
- SHA256
  
  9f57f29bc1da6b84255a1164c0394834713dd073a6b01f06b4bc2b6ebab0b96f
- SHA512
  
  603b8fd0f3463a7106b6a6817b44d8275bbe4edaf1b4d58a7a085ed1e534d7ec5962ae440b736dbb5a82c1c8cb20f369a4c7b15580425c6eca4e18c44e7a9e9c
- SSDEEP
  
  3072:f5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdVPe/vGC5iIO/Sl1BhI3QoD:fM80mniiLU7QPerPavj7k41PI3QoD
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan