General
-
Target
568-65-0x0000000000400000-0x000000000044A000-memory.dmp
-
Size
296KB
-
MD5
60d7e9dc4ecf5edebc72d8961386bf60
-
SHA1
c5abe32b490929e293542ed9c9387ed243933bf9
-
SHA256
9af95a80c11eceee53a072f72506ccee7bebe62b3e573b2ed3300d51dfe980ac
-
SHA512
f5cec91c3e19f3fd32607e58a5aed58111b604908dbd8a3888def610c81745bace75d6de84e1058bb66d5fa938f2c2b67af408e502a40a4810f2e9d67294578c
-
SSDEEP
6144:XCteODDmzKawLV6Bta6dtJmakIM59zxAnuBlMvBZORk:Xe3+ELV6BtpmkIxAIFk
Score
10/10
Malware Config
Extracted
Family
nanocore
Version
1.2.2.0
C2
stepin.duckdns.org:6060
Mutex
07500443-0d0d-4302-aaa5-75c45bf1f66d
Attributes
-
activate_away_mode
true
-
backup_connection_host
stepin.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-12-02T08:08:14.245169036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6060
-
default_group
Sauce
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
07500443-0d0d-4302-aaa5-75c45bf1f66d
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
stepin.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
Files
-
568-65-0x0000000000400000-0x000000000044A000-memory.dmp
Headers
Sections