nanocore | 132a36be9c7dc024233a459eee26cf4b19dd881c3b4b2ec8e66c92198a6bfdb1 | Triage

Sharing

General

Target

132a36be9c7dc024233a459eee26cf4b19dd881c3b4b2ec8e66c92198a6bfdb1
Size

158KB
Sample

221123-lpen4abh49
MD5

b32334f49df9ef848b4bc3083e0c89a9
SHA1

901d0541e50113c0eec4fd178d3a172c8b11e761
SHA256

132a36be9c7dc024233a459eee26cf4b19dd881c3b4b2ec8e66c92198a6bfdb1
SHA512

935896d4d62959c19df30c73ee1f578e305fc85c8790f9bf9923557e556f41a29bbcf399c9cb38746bf111b5e7ed25cb58178033125750b1cddd2fcfd6470ceb
SSDEEP

3072:C5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdV5pcWNbzbjQ:CM80mniiLU7QPer5prlzXQ

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  132a36be9c7dc024233a459eee26cf4b19dd881c3b4b2ec8e66c92198a6bfdb1
- Size
  
  158KB
- MD5
  
  b32334f49df9ef848b4bc3083e0c89a9
- SHA1
  
  901d0541e50113c0eec4fd178d3a172c8b11e761
- SHA256
  
  132a36be9c7dc024233a459eee26cf4b19dd881c3b4b2ec8e66c92198a6bfdb1
- SHA512
  
  935896d4d62959c19df30c73ee1f578e305fc85c8790f9bf9923557e556f41a29bbcf399c9cb38746bf111b5e7ed25cb58178033125750b1cddd2fcfd6470ceb
- SSDEEP
  
  3072:C5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdV5pcWNbzbjQ:CM80mniiLU7QPer5prlzXQ
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan