nanocore

Sharing

Copy URL Twitter E-mail

General

Target
27ab3261c4bb0bbf78f09ff724230ba3_JaffaCakes118
Size 7.2MB
Sample240509-by1mtadf43
SHA256 38f1fb1d891e685a1118d70c7277488b7bc3ae9fe4ecbd5964b9a20b4fbaa23a
MD5 27ab3261c4bb0bbf78f09ff724230ba3
SHA1 d82fd16e6cd73903e556d5697765c698e8559338
SHA512 93454ddcaf82c701cab98d1531c10c08d8912bdb0846f77cd8934c6f18fd9cbeef54a6fd4735d6da48e9218055478e2308be74fcd1fec8f92a1861a899ef3949
SSDEEP 196608:WXjcPGtlIISEgSCDMMcryHl/B2wk/tXDS25j:kjc+tlIIDgSN7rClClb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

javarat.ddns.net:2957

Mutex

d8e93ad9-46a7-445b-ae2e-59da45d1349c

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2016-02-11T16:48:17.570210736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2957
default_group
New
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
d8e93ad9-46a7-445b-ae2e-59da45d1349c
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
javarat.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  ClientPlugin.dll
- Size 19KB
- SHA256 61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
- MD5 bdc8945f1d799c845408522e372d1dbd
- SHA1 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
- SHA512 4fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962
- SSDEEP 192:VYLQui6h6p5WW3tZVTnlYJL/eLYLTr2/C8:VYLQu/6/fKqLYLTR
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Nanacore 1.2.5 Cracked By Alcatraz3222.exe
- Size 5.6MB
- SHA256 77444937c108f7a59949c38115b0834f894ee92a0af8a3bf7e3ca7c068e29a4f
- MD5 fe0476b2b73a333fc0ab4069b2d02d85
- SHA1 7f489676abf60a516c42d9fa66888bd78daddcb5
- SHA512 c869b48bad8d8f1debd9076e3fc563ec46e6984a45c4ef0f39f18b5856eb3c86ab367be993fac2ee704098201ff05a6ebb35cebefbd64bf5cdc4f8e2c7fe4023
- SSDEEP 49152:YZbzLuGUqF3/nuqE7UoVgrHs2c62h4wpGI9gMpx:
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral3 behavioral4
- Target
  PluginCompiler.exe
- Size 75KB
- SHA256 0b41b2fcd0f1a4e913d3efe293f713849d59efebb27bac060ab31bed51ac2f6b
- MD5 e2d1c5df11f9573f6c5d0a7ad1a79fbf
- SHA1 b32bf571aca1b51af48f7f2f955aaf1bbdc5aa2f
- SHA512 9c9ae7baa504dd34311f5730280f6a49e10eefdb145d2d29849e385a7da47c8f2c182cd6f39949f5904ef8462fc5c3dfaf1bc4cc8bff50c6750c9edc886192e0
- SSDEEP 1536:iyVzgm8NqToL6n975lw8FDx39EhPKu4iV1Y:iyVMLUTos5SAx3ChPKpiVe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  ServerPlugin.dll
- Size 28KB
- SHA256 2e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7
- MD5 952c62ec830c63380beb72ad923d35dc
- SHA1 6700baa1fb1877129e79402dfe237f0b84221b69
- SHA512 5dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121
- SSDEEP 384:7LmAEURVWGSCyo6/NLoqwXEsZmLTdFuoKy:vm1izOlg0ZKy
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  System.Data.SQLite.dll
- Size 256KB
- SHA256 f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4
- MD5 dd3d6f00b1aba3f1d9338d9727ab5f17
- SHA1 faf9364a7ab15f27c93a6e6f97fa025030c9dad7
- SHA512 0794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7
- SSDEEP 6144:icvnEsATddHqgM69uZ5iFNFGFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchF1:icvnEygM69uZ8FNFGFOFwcGF6cmFWc0z
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  client.bin
- Size 130KB
- SHA256 9d3ea5af7dc261bf93c76f55d702a315aa22fb241e4207dc86cd834c262245c8
- MD5 906a949e34472f99ba683eff21907231
- SHA1 7c5a57af209597fa6c6bce7d1a8016b936d3b0b6
- SHA512 29fd20ae7f1b8bac831c0bb85da4325a62e10961989e14299f5f50776c8f7e669cc1527bf2c3868bd7230e73ac110ba8b1f0491ac0f2923d79d7a2871c7c961d
- SSDEEP 3072:pzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI0AkU:pLV6Bta6dtJmakIM5VU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

nanocore evasion keylogger spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Checks whether UAC is enabled
  evasion trojan
behavioral11 behavioral12
- Target
  x64/SQLite.Interop.dll
- Size 1.3MB
- SHA256 270d61d183cff3dafad0db3dbe7942374552044baea1e28411c3a143cb620c02
- MD5 382398711315e2fa8e93d305b4873908
- SHA1 51482242e6d9170963aa27192c8279d20fce19ce
- SHA512 084217e67c125cb9952b91bc9783faf5c1e8fb01750cc1e6b4c3736c47b74dcf3207979c1c497e630e161aff529f71c403af6ca0232a7c3e9e587b58e4495589
- SSDEEP 24576:fG4Gnwh2IK88uyMGI1YSbmdtDxnrW1oC0AZDvDetNQT7f+5eKMUxThC35:ewh2IKAYjtNme5eeG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  x86/SQLite.Interop.dll
- Size 792KB
- SHA256 3515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38
- MD5 9b19dcee960dc215e64b1d82348707a9
- SHA1 9c1e0f76673eb385787120e17404df179316ca2b
- SHA512 cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d
- SSDEEP 12288:iIF0SBEkDG7/jznRefvOIVcn4PW5d6PrVJNcdwLzs9w:iIYkDG7rznRenOIVc4PW76TbK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

NanoCore

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16