nanocore

General

Target
8a9d5b1d0b60de8dbff6adb22f964030.bin
Size 6.2MB
Sample240204-cxt93shgcl
SHA256 e372a026f9c65009e15ba110a075dc993e5ac0e12add4fcca36e61ab71f76291
MD5 8a9d5b1d0b60de8dbff6adb22f964030
SHA1 9e1a7323038b43b1bb09f846e8c72e5f4665585a
SHA512 0a0bccd1722451a64bd2f7f865979ee8b165de55271354b9f345af8dc7066d345c4a7d1bef87ed27ddba8e51fd7bc5733f1a4cc1f5e2dc3a675e3dd718c8aba6
SSDEEP 98304:ygSY9IHT0a+3ivuWW8Ms7riWw69V/tlL231hOTqdy8ThGjdz/1X8KXhhCesC:ygS5Hjhn37uWw6Pfi3rdgTX8IuC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

geppasser.ddns.net:1337
127.0.0.1:1337

Mutex

46092fea-59b4-4f42-8a2b-48d0a688aff3

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-07-26T16:17:59.507526836Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1337
default_group
Mine
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
46092fea-59b4-4f42-8a2b-48d0a688aff3
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
geppasser.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  Новая папка/NVIDIA Container.exe
- Size 202KB
- SHA256 f64301d34383f81645e95b8c97be0dc8deb9653c09597d463269977f99ff10d2
- MD5 837a6a75b4868e03594a936e1eed6ac3
- SHA1 041e2ab3f4f32c35a50d36631c18e308829be8c5
- SHA512 7f6ccd5875dd0a8b730c223606fa3531f3c8eeee70357f3ff04831fc78bf1daab4a6437eccaf0caf2d3450a773e257005610654f9dd656a82ab0b00ab6ba1293
- SSDEEP 3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIbPcsD6RA5E3bKKiCf3e0kYrOm:gLV6Bta6dtJmakIM5+cs8A5ELiUfo6
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2
- Target
  Новая папка/Xenos64.exe
- Size 1.1MB
- SHA256 e76c38ad723e6a8e433c8e155396c2b469e69ca505b7cbc4a0ba34aca7981dfc
- MD5 776e5f12ef19d4353b89adffaefe7bb7
- SHA1 ed52cb71630beb06eecf197208592232640baa48
- SHA512 26fab6fa8aed5d11a9439b88a7f1f7075bc244108b30ee18b911e500af9e174e5ad20260d16831f2a9c7c68062e7f9f584b2fb1a37079eff4000c02cbf053257
- SSDEEP 24576:PSxykWeIX+bE+LcmEtr1GGW6UsBaIarNFphbN1+/:PSx3gfYPEeUUsYIar6/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral3 behavioral4
- Target
  Новая папка/Yammi[1.7.10].dll
- Size 5.5MB
- SHA256 98f54cd508b7b400cdf1f92c8f553516f630bdbe6ff6b79b99d08668326c9541
- MD5 ef7f78b0ad6d61d898ec0c5416e930b1
- SHA1 ea15c22b3ffefafa0edb7e4f1695fcd361f71ee9
- SHA512 5663cba40cb5ff63615331e060292727b34d37195329a0c9635d79c7fd6a3fbc90a36bb53eb3ad3a3d2b25579df1a6174da4b58ed6f5924f20093e7096a97d04
- SSDEEP 98304:8UJG7pS2bB0diMi/lWgUl0Xw1OKTsw7wDb4AFKVRNqC3QI97HoS:527V0UMi/nsGwCwk6NqCQc7I
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral5 behavioral6