Behavioral task
behavioral1
Sample
4a43753faeec86069ff30b5066216e2ae45f2c541b7b4f325cc3a1508683e79c.exe
Resource
win7-20220812-en
General
-
Target
4a43753faeec86069ff30b5066216e2ae45f2c541b7b4f325cc3a1508683e79c
-
Size
117KB
-
MD5
ff41fbe72462d4214b55abae0788a965
-
SHA1
6fad1cb5e32dd99618ced84c6b1ef2b5e8cde8e1
-
SHA256
4a43753faeec86069ff30b5066216e2ae45f2c541b7b4f325cc3a1508683e79c
-
SHA512
8128c8d3d4765589ca52515a1da05f0726611bf70b730a7e33b47e5658ae157a0fbde1d8c64799d6a364e15ecb4f9cc8ac70e3df087e2e19c990882e4cd1f5ef
-
SSDEEP
3072:MbpZKxysDiVsd8fHyXORSksrHyReACFWTl+N9bvo:MbpUyVszXOTsDyR4NZQ
Malware Config
Extracted
nanocore
-
activate_away_mode
false
- backup_connection_host
- backup_dns_server
-
buffer_size
0
-
build_time
0001-01-01T00:00:00Z
-
bypass_user_account_control
false
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
0
-
connection_port
0
- default_group
-
enable_debug_mode
false
-
gc_threshold
0
-
keep_alive_timeout
0
-
keyboard_logging
false
-
lan_timeout
0
-
max_packet_size
0
- mutex
-
mutex_timeout
0
-
prevent_system_sleep
false
- primary_connection_host
- primary_dns_server
-
request_elevation
false
-
restart_delay
0
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
0
-
use_custom_dns_server
false
- version
-
wan_timeout
0
Signatures
-
Nanocore family
Files
-
4a43753faeec86069ff30b5066216e2ae45f2c541b7b4f325cc3a1508683e79c.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ