nanocore | 9b51ab6d4d37b31fa9dc7f82bb48f7ef3c836e4228d3f88d72117eeb20723b51 | Triage

Sharing

General

Target

9b51ab6d4d37b31fa9dc7f82bb48f7ef3c836e4228d3f88d72117eeb20723b51
Size

199KB
Sample

221123-lpbx7sbh45
MD5

b69492e3d099bc344c93c596e044ed29
SHA1

bb8af0339fcff82a0864677b2cea0e0f5587f7ee
SHA256

9b51ab6d4d37b31fa9dc7f82bb48f7ef3c836e4228d3f88d72117eeb20723b51
SHA512

d38a4882f6423c941d778f3f7e3d3f76591dcfa079f49d7f8173e23ca6f37f94e98febf2154b53b5997a8dcb487b6f053dfcac2984ff5f60b60dacce87d971bb
SSDEEP

3072:r5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdV0Qh85QG1ooemavRBzsoHkN:rM80mniiLU7QPerNh8Pa7BHkN

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  9b51ab6d4d37b31fa9dc7f82bb48f7ef3c836e4228d3f88d72117eeb20723b51
- Size
  
  199KB
- MD5
  
  b69492e3d099bc344c93c596e044ed29
- SHA1
  
  bb8af0339fcff82a0864677b2cea0e0f5587f7ee
- SHA256
  
  9b51ab6d4d37b31fa9dc7f82bb48f7ef3c836e4228d3f88d72117eeb20723b51
- SHA512
  
  d38a4882f6423c941d778f3f7e3d3f76591dcfa079f49d7f8173e23ca6f37f94e98febf2154b53b5997a8dcb487b6f053dfcac2984ff5f60b60dacce87d971bb
- SSDEEP
  
  3072:r5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdV0Qh85QG1ooemavRBzsoHkN:rM80mniiLU7QPerNh8Pa7BHkN
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan