General
-
Target
df0d564ac08499a74f09b6bc9f89e94d41b027a1c238dac8539c477a64e84879
-
Size
500KB
-
Sample
221125-kqb4xshh7w
-
MD5
ccd7564206444e7cf754185f171d59a4
-
SHA1
980979cb8609b7928966047988ec696f84a7f0de
-
SHA256
df0d564ac08499a74f09b6bc9f89e94d41b027a1c238dac8539c477a64e84879
-
SHA512
82996a048a72aa97172f99cf1600fe64cd183d2a1a4724c0db74da556530a25474a62d580a43e18827b9ca54f9faf61ac22799dcfcf85f722fbb488a887da2b7
-
SSDEEP
12288:IdUSr2Grj/zRR4jAbIBu5AzNEJGUVDwJfSa0SlaCzi6:IdUSr5CAG2tJGUVDw0Cg8
Static task
static1
Behavioral task
behavioral1
Sample
df0d564ac08499a74f09b6bc9f89e94d41b027a1c238dac8539c477a64e84879.exe
Resource
win7-20220812-en
Malware Config
Extracted
nanocore
1.2.2.0
anunankis1.duckdns.org:5555
anunankis11.duckdns.org:5555
ae7a07e8-203a-461c-8998-02b485f17681
-
activate_away_mode
false
-
backup_connection_host
anunankis11.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-16T17:16:05.859015836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
5555
-
default_group
....0NinfaGith
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ae7a07e8-203a-461c-8998-02b485f17681
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
anunankis1.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
df0d564ac08499a74f09b6bc9f89e94d41b027a1c238dac8539c477a64e84879
-
Size
500KB
-
MD5
ccd7564206444e7cf754185f171d59a4
-
SHA1
980979cb8609b7928966047988ec696f84a7f0de
-
SHA256
df0d564ac08499a74f09b6bc9f89e94d41b027a1c238dac8539c477a64e84879
-
SHA512
82996a048a72aa97172f99cf1600fe64cd183d2a1a4724c0db74da556530a25474a62d580a43e18827b9ca54f9faf61ac22799dcfcf85f722fbb488a887da2b7
-
SSDEEP
12288:IdUSr2Grj/zRR4jAbIBu5AzNEJGUVDwJfSa0SlaCzi6:IdUSr5CAG2tJGUVDw0Cg8
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-