nanocore

General

Target

73371a04380683a8c5e28e73f8a74b604441f445ae898bdcd25f364c39b34c15
Size

408KB
Sample

221126-kzfhpsff65
MD5

a99a3908f39c9938c93a645ed8a00211
SHA1

1cb84a1cc3d9e3caedc95c59910fc41e9da50cff
SHA256

73371a04380683a8c5e28e73f8a74b604441f445ae898bdcd25f364c39b34c15
SHA512

fee46cb29bd3f3cc682c34ddae08ae3574be34a7107eebabefdee12d100a9feda4bae408062d2fb99a37294b436a187be44f6b8312c6bb81276f619196e978fb
SSDEEP

12288:VojzsKXS4wpRVSVQfNWf2GE5XafzJIMo6mRojzsKki:eYNpj+oXafz/mqY3i

Score

10^/10

Malware Config

Targets

- Target
  
  73371a04380683a8c5e28e73f8a74b604441f445ae898bdcd25f364c39b34c15
- Size
  
  408KB
- MD5
  
  a99a3908f39c9938c93a645ed8a00211
- SHA1
  
  1cb84a1cc3d9e3caedc95c59910fc41e9da50cff
- SHA256
  
  73371a04380683a8c5e28e73f8a74b604441f445ae898bdcd25f364c39b34c15
- SHA512
  
  fee46cb29bd3f3cc682c34ddae08ae3574be34a7107eebabefdee12d100a9feda4bae408062d2fb99a37294b436a187be44f6b8312c6bb81276f619196e978fb
- SSDEEP
  
  12288:VojzsKXS4wpRVSVQfNWf2GE5XafzJIMo6mRojzsKki:eYNpj+oXafz/mqY3i
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2