General
-
Target
00e7aab668ba6a8dcecf186d5fc789c3.bin
-
Size
157KB
-
MD5
bb2ce0a41a9febcf623ff38498f877a8
-
SHA1
e7f8b675bb74759048336b227868e80dea76266d
-
SHA256
1e19964a44d19681e46b37a2fc1867cc6e9f85fc4c027e4579e007c57da67da6
-
SHA512
1f6628b6936ef949b8eeabf5a0a0e4881d9615adcb6bed69d0c19dfb03a92e6ae33adcd9f3c3a2507aa3bab888cad6fb39df95c1b67b57de3adee76c8106ceae
-
SSDEEP
3072:cDuVf3TIpE74No65SXxPBc86bV9ge2VKIhHdpHPWRw3LuNayaPTXEUjCw/gQSo:FHgo6CpcP8erINHPWvNxaPTdfg+
Malware Config
Extracted
nanocore
1.2.2.0
segun.ddns.net:7001
127.0.0.1:7001
60e9df5f-2e4d-487b-aa60-cc1a1a419a32
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-07-29T11:51:40.468786936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7001
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
60e9df5f-2e4d-487b-aa60-cc1a1a419a32
-
mutex_timeout
5021
-
prevent_system_sleep
false
-
primary_connection_host
segun.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5026
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
00e7aab668ba6a8dcecf186d5fc789c3.bin
Password: infected
-
c014e9ea2000ac1f4663379a97c30cc53701ea83b02e4de0e8d34e4758de76d2.exe
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections