General
- Target 483db1810892de080346e097caf9635b_JaffaCakes118
- Size 512KB
- Sample240331-apmtxsab9w
- SHA256 075e22ceed2efd644ae7b4f5a9232d7fc902c6b89d8b7314f442f358a23981b1
Score
10/10
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
bestzones.ddns.net:7777
Mutex
-
483b7f1c-9ce3-4fd8-a962-61a5f5a4c924
Attributes
-
activate_away_mode
true
-
backup_connection_host
bestzones.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-06-01T21:31:53.630408036Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
7777
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
483b7f1c-9ce3-4fd8-a962-61a5f5a4c924
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
bestzones.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
- Target 483db1810892de080346e097caf9635b_JaffaCakes118
- Size 512KB
- SHA256 075e22ceed2efd644ae7b4f5a9232d7fc902c6b89d8b7314f442f358a23981b1
Score10/10NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks whether UAC is enabled
Drops desktop.ini file(s)
Suspicious use of SetThreadContext