nanocore | 8a9d5b1d0b60de8dbff6adb22f964030[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
8a9d5b1d0b60de8dbff6adb22f964030.bin
Size 6.2MB
Sample240204-cxt93shgcl
SHA256 e372a026f9c65009e15ba110a075dc993e5ac0e12add4fcca36e61ab71f76291
MD5 8a9d5b1d0b60de8dbff6adb22f964030
SHA1 9e1a7323038b43b1bb09f846e8c72e5f4665585a
SHA512 0a0bccd1722451a64bd2f7f865979ee8b165de55271354b9f345af8dc7066d345c4a7d1bef87ed27ddba8e51fd7bc5733f1a4cc1f5e2dc3a675e3dd718c8aba6
SSDEEP 98304:ygSY9IHT0a+3ivuWW8Ms7riWw69V/tlL231hOTqdy8ThGjdz/1X8KXhhCesC:ygS5Hjhn37uWw6Pfi3rdgTX8IuC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vmprotect nanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

geppasser.ddns.net:1337
127.0.0.1:1337

Mutex

46092fea-59b4-4f42-8a2b-48d0a688aff3

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-07-26T16:17:59.507526836Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1337
default_group
Mine
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
46092fea-59b4-4f42-8a2b-48d0a688aff3
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
geppasser.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Nanocore family
nanocore

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/Новая папка/Yammi[1.7.10].dll	vmprotect

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Новая папка/NVIDIA Container.exe
unpack001/Новая папка/Xenos64.exe
unpack001/Новая папка/Yammi[1.7.10].dll

File Explorer

8a9d5b1d0b60de8dbff6adb22f964030.bin

.7z 6.2MB
Новая папка/NVIDIA Container.exe

.exe 202KB
Новая папка/Xenos64.exe

.exe 1.1MB
Новая папка/Yammi[1.7.10].dll

.dll 5.5MB

8a9d5b1d0b60de8dbff6adb22f964030.bin

SHA256 e372a026f9c65009e15ba110a075dc993e5ac0e12add4fcca36e61ab71f76291
MD5 8a9d5b1d0b60de8dbff6adb22f964030
SHA1 9e1a7323038b43b1bb09f846e8c72e5f4665585a
SHA512 0a0bccd1722451a64bd2f7f865979ee8b165de55271354b9f345af8dc7066d345c4a7d1bef87ed27ddba8e51fd7bc5733f1a4cc1f5e2dc3a675e3dd718c8aba6
SSDEEP 98304:ygSY9IHT0a+3ivuWW8Ms7riWw69V/tlL231hOTqdy8ThGjdz/1X8KXhhCesC:ygS5Hjhn37uWw6Pfi3rdgTX8IuC
MD5 SHA1 SHA512 SSDEEP

Новая папка/NVIDIA Container.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f64301d34383f81645e95b8c97be0dc8deb9653c09597d463269977f99ff10d2
MD5 837a6a75b4868e03594a936e1eed6ac3
SHA1 041e2ab3f4f32c35a50d36631c18e308829be8c5
SHA512 7f6ccd5875dd0a8b730c223606fa3531f3c8eeee70357f3ff04831fc78bf1daab4a6437eccaf0caf2d3450a773e257005610654f9dd656a82ab0b00ab6ba1293
SSDEEP 3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIbPcsD6RA5E3bKKiCf3e0kYrOm:gLV6Bta6dtJmakIM5+cs8A5ELiUfo6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

124818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Новая папка/Xenos64.exe

IMPHASH 94400fe3e62cd2376124312fe435b8e4
SHA256 e76c38ad723e6a8e433c8e155396c2b469e69ca505b7cbc4a0ba34aca7981dfc
MD5 776e5f12ef19d4353b89adffaefe7bb7
SHA1 ed52cb71630beb06eecf197208592232640baa48
SHA512 26fab6fa8aed5d11a9439b88a7f1f7075bc244108b30ee18b911e500af9e174e5ad20260d16831f2a9c7c68062e7f9f584b2fb1a37079eff4000c02cbf053257
SSDEEP 24576:PSxykWeIX+bE+LcmEtr1GGW6UsBaIarNFphbN1+/:PSx3gfYPEeUUsYIar6/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Новая папка/Yammi[1.7.10].dll

IMPHASH 4aba38aa71d6c44b05bc097a9a7b6c8a
SHA256 98f54cd508b7b400cdf1f92c8f553516f630bdbe6ff6b79b99d08668326c9541
MD5 ef7f78b0ad6d61d898ec0c5416e930b1
SHA1 ea15c22b3ffefafa0edb7e4f1695fcd361f71ee9
SHA512 5663cba40cb5ff63615331e060292727b34d37195329a0c9635d79c7fd6a3fbc90a36bb53eb3ad3a3d2b25579df1a6174da4b58ed6f5924f20093e7096a97d04
SSDEEP 98304:8UJG7pS2bB0diMi/lWgUl0Xw1OKTsw7wDb4AFKVRNqC3QI97HoS:527V0UMi/nsGwCwk6NqCQc7I
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4480795

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

978B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

729KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

8a9d5b1d0b60de8dbff6adb22f964030.bin

Новая папка/NVIDIA Container.exe

mscoree

dotnet

Новая папка/Xenos64.exe

user32

kernel32

shlwapi

generic

Новая папка/Yammi[1.7.10].dll

kernel32

user32

wtsapi32

generic