Overview

overview

10

Static

static

10

Новая...er.exe

windows7-x64

10

Новая...er.exe

windows10-2004-x64

10

Новая...64.exe

windows7-x64

10

Новая...64.exe

windows10-2004-x64

10

Новая...0].dll

windows7-x64

7

Новая...0].dll

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    8a9d5b1d0b60de8dbff6adb22f964030.bin

  • Size

    6.2MB

  • MD5

    8a9d5b1d0b60de8dbff6adb22f964030

  • SHA1

    9e1a7323038b43b1bb09f846e8c72e5f4665585a

  • SHA256

    e372a026f9c65009e15ba110a075dc993e5ac0e12add4fcca36e61ab71f76291

  • SHA512

    0a0bccd1722451a64bd2f7f865979ee8b165de55271354b9f345af8dc7066d345c4a7d1bef87ed27ddba8e51fd7bc5733f1a4cc1f5e2dc3a675e3dd718c8aba6

  • SSDEEP

    98304:ygSY9IHT0a+3ivuWW8Ms7riWw69V/tlL231hOTqdy8ThGjdz/1X8KXhhCesC:ygS5Hjhn37uWw6Pfi3rdgTX8IuC

Score
10/10
vmprotectnanocore

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

geppasser.ddns.net:1337

127.0.0.1:1337
Mutex

46092fea-59b4-4f42-8a2b-48d0a688aff3

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2019-07-26T16:17:59.507526836Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    1337

  • default_group

    Mine

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    46092fea-59b4-4f42-8a2b-48d0a688aff3

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    geppasser.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • Nanocore family
    nanocore
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • 8a9d5b1d0b60de8dbff6adb22f964030.bin
    .7z
  • Новая папка/NVIDIA Container.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Новая папка/Xenos64.exe
    .exe windows:4 windows x86 arch:x86

    94400fe3e62cd2376124312fe435b8e4


    Headers

    Imports

    Sections

  • Новая папка/Yammi[1.7.10].dll
    .dll windows:6 windows x64 arch:x64

    4aba38aa71d6c44b05bc097a9a7b6c8a


    Headers

    Imports

    Sections