nanocore | 016bfd15e2a4a41d6916ca4d4835b6a073bd485aec9ee6e2e8b6438005a7b282 | Triage

Sharing

General

Target

016bfd15e2a4a41d6916ca4d4835b6a073bd485aec9ee6e2e8b6438005a7b282
Size

158KB
Sample

221123-lpghpafc9w
MD5

9be8efe09b22b211d1fb57071d394f21
SHA1

e6813dde9112e7af6cdf116bc7e7b8cb5ed5e734
SHA256

016bfd15e2a4a41d6916ca4d4835b6a073bd485aec9ee6e2e8b6438005a7b282
SHA512

850fe84ebc223acafcb17d19460d29299ce14b45c50f521cbe1f7da9e0ab606d1b933e2daee10f331f950b4516ce7a9c983e39c8942b1fa37921ef7afbaf7533
SSDEEP

3072:S5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdVWDCZpTUV4HTe3HabaB:SM80mniiLU7QPerW+/TbHTe3c2

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  016bfd15e2a4a41d6916ca4d4835b6a073bd485aec9ee6e2e8b6438005a7b282
- Size
  
  158KB
- MD5
  
  9be8efe09b22b211d1fb57071d394f21
- SHA1
  
  e6813dde9112e7af6cdf116bc7e7b8cb5ed5e734
- SHA256
  
  016bfd15e2a4a41d6916ca4d4835b6a073bd485aec9ee6e2e8b6438005a7b282
- SHA512
  
  850fe84ebc223acafcb17d19460d29299ce14b45c50f521cbe1f7da9e0ab606d1b933e2daee10f331f950b4516ce7a9c983e39c8942b1fa37921ef7afbaf7533
- SSDEEP
  
  3072:S5Pto80z+vFMCnOzS9FL9sGR2uRyR7QPMtdVWDCZpTUV4HTe3HabaB:SM80mniiLU7QPerW+/TbHTe3c2
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2