nanocore

General

Target
f4e6123b834615cc3d94b58d393f3097_JaffaCakes118
Size 10.0MB
Sample240417-dk13jaca34
SHA256 9d2f5d46b02f236f8588bb1e0695059744fb3ff5eace01755cd883fafae33b77
MD5 f4e6123b834615cc3d94b58d393f3097
SHA1 26abd8f8c180dcec99a60c2475c4fe7bb69555b5
SHA512 cefae5262428c16464e23e0994d95f382c559f64614b20346c3ae1f846ef03598cac564b457749f7a0c03d490a7c40b05b41715609d64f6faf08829166e9572b
SSDEEP 196608:188rXcaGUbxE0H2o8rbowQ8pvwMCquMklnxIt2JWHthvf2bF7CZJbs6Gw1TBB:18q9GbPboQvRCrM2FJWHnvf2bxC/x71n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  f4e6123b834615cc3d94b58d393f3097_JaffaCakes118
- Size 10.0MB
- SHA256 9d2f5d46b02f236f8588bb1e0695059744fb3ff5eace01755cd883fafae33b77
- MD5 f4e6123b834615cc3d94b58d393f3097
- SHA1 26abd8f8c180dcec99a60c2475c4fe7bb69555b5
- SHA512 cefae5262428c16464e23e0994d95f382c559f64614b20346c3ae1f846ef03598cac564b457749f7a0c03d490a7c40b05b41715609d64f6faf08829166e9572b
- SSDEEP 196608:188rXcaGUbxE0H2o8rbowQ8pvwMCquMklnxIt2JWHthvf2bF7CZJbs6Gw1TBB:18q9GbPboQvRCrM2FJWHnvf2bxC/x71n
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

nanocore evasion keylogger spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2