Overview

overview

10

Static

static

5

ee3594cc88...82.exe

windows7-x64

10

ee3594cc88...82.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee3594cc88a44e60adc7c5ed81ae95732a93e0a31ad0490ae5b3548ebaae8d82

  • Size

    1.0MB

  • Sample

    221127-z2yjmahg54

  • MD5

    4cd314d065752bc863a44ac409691560

  • SHA1

    66d0fe99f3d70181970207ee5c77a90a735b5cda

  • SHA256

    ee3594cc88a44e60adc7c5ed81ae95732a93e0a31ad0490ae5b3548ebaae8d82

  • SHA512

    47689aed4323b64e8422c9ff31d537265a3fc5ba9c25619bbafa6191bb58f1bb877a4df17755074b7fe6d4c8c485d52bf7fc5d1f7864fe45973f03f24c829504

  • SSDEEP

    24576:7tb20pkaCqT5TBWgNQ7agvu3QS8Vhx9V6A:4Vg5tQ7agvOQSgp5

Score
10/10
nanocorekeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

adam150994.mooo.com:666

127.0.0.1:666
Mutex

3f5b9758-4849-4f30-aba2-77bb2368243b

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2015-01-10T20:36:58.967694336Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    true

  • connect_delay

    4000

  • connection_port

    666

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    3f5b9758-4849-4f30-aba2-77bb2368243b

  • mutex_timeout

    5000

  • prevent_system_sleep

    true

  • primary_connection_host

    adam150994.mooo.com

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      ee3594cc88a44e60adc7c5ed81ae95732a93e0a31ad0490ae5b3548ebaae8d82

    • Size

      1.0MB

    • MD5

      4cd314d065752bc863a44ac409691560

    • SHA1

      66d0fe99f3d70181970207ee5c77a90a735b5cda

    • SHA256

      ee3594cc88a44e60adc7c5ed81ae95732a93e0a31ad0490ae5b3548ebaae8d82

    • SHA512

      47689aed4323b64e8422c9ff31d537265a3fc5ba9c25619bbafa6191bb58f1bb877a4df17755074b7fe6d4c8c485d52bf7fc5d1f7864fe45973f03f24c829504

    • SSDEEP

      24576:7tb20pkaCqT5TBWgNQ7agvu3QS8Vhx9V6A:4Vg5tQ7agvOQSgp5

    Score
    10/10
    nanocorekeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks