General

  • Target

    b6264e949c8f0569b9ecd990c38e3cb257ce0a17bd6a2f4b22aa68c467403781

  • Size

    452KB

  • Sample

    221127-w8fqlshh79

  • MD5

    0015473a4b9a03266d07adcdf42d85f5

  • SHA1

    97b11d50724e593a0bcccd3dbc39ed0478eba2c6

  • SHA256

    b6264e949c8f0569b9ecd990c38e3cb257ce0a17bd6a2f4b22aa68c467403781

  • SHA512

    64aaf2d209cddc3bef1a7193c9323b194146dec909af53cd9c506838e0a715a495beacb0e3947817f3e0f4902000070a7af95bd3be988bb5e4f300f6a8e2f1ee

  • SSDEEP

    12288:H/4hHVxvs6qlqZcFAuHzw4eCS+UC3axI7Xz/pkE+vGjW:H/4h1xDcFvHzw4eCHgG

Malware Config

Extracted

Family

nanocore

Version

1.2.1.1

C2

swagkhalifa.ddns.net:1338

Mutex

8db103a2-1d76-45a9-82c0-563893196fa0

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

  • buffer_size

    65535

  • build_time

    2014-09-17T00:28:30.859680336Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    1338

  • default_group

    Spreading Service

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    8db103a2-1d76-45a9-82c0-563893196fa0

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    swagkhalifa.ddns.net

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.1.1

  • wan_timeout

    8000

Targets

    • Target

      b6264e949c8f0569b9ecd990c38e3cb257ce0a17bd6a2f4b22aa68c467403781

    • Size

      452KB

    • MD5

      0015473a4b9a03266d07adcdf42d85f5

    • SHA1

      97b11d50724e593a0bcccd3dbc39ed0478eba2c6

    • SHA256

      b6264e949c8f0569b9ecd990c38e3cb257ce0a17bd6a2f4b22aa68c467403781

    • SHA512

      64aaf2d209cddc3bef1a7193c9323b194146dec909af53cd9c506838e0a715a495beacb0e3947817f3e0f4902000070a7af95bd3be988bb5e4f300f6a8e2f1ee

    • SSDEEP

      12288:H/4hHVxvs6qlqZcFAuHzw4eCS+UC3axI7Xz/pkE+vGjW:H/4h1xDcFvHzw4eCHgG

MITRE ATT&CK Enterprise v6

Tasks