nanocore | 6544b77a49112f3bec091f297c525f48bb59b6e4dc15b709ddfbe904e59ef059 | Triage

Sharing

General

Target

6544b77a49112f3bec091f297c525f48bb59b6e4dc15b709ddfbe904e59ef059
Size

204KB
Sample

221123-lpc59sfc8y
MD5

37850a305ea26436528909e8b8c889da
SHA1

c8ed2a82628c20c8654f3e06bec194150773a4e3
SHA256

6544b77a49112f3bec091f297c525f48bb59b6e4dc15b709ddfbe904e59ef059
SHA512

1fa917b4cf0d94a3df59f7faf53da626609d655c0b76365f67d1e9d743bc9922c445b1546b501344137ac8e15c057abf634d0f815e58fef58b7843fc3a0989e6
SSDEEP

6144:9M80mniiLU7QPerusFf2Cj18LxyUQv9XY:9Lj67QPqL918LxsvZY

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  6544b77a49112f3bec091f297c525f48bb59b6e4dc15b709ddfbe904e59ef059
- Size
  
  204KB
- MD5
  
  37850a305ea26436528909e8b8c889da
- SHA1
  
  c8ed2a82628c20c8654f3e06bec194150773a4e3
- SHA256
  
  6544b77a49112f3bec091f297c525f48bb59b6e4dc15b709ddfbe904e59ef059
- SHA512
  
  1fa917b4cf0d94a3df59f7faf53da626609d655c0b76365f67d1e9d743bc9922c445b1546b501344137ac8e15c057abf634d0f815e58fef58b7843fc3a0989e6
- SSDEEP
  
  6144:9M80mniiLU7QPerusFf2Cj18LxyUQv9XY:9Lj67QPqL918LxsvZY
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan