nanocore | 4ea150ff416821c0b65ae4990456126c4912f6745fc720bfc6874b45032908df | Triage

Sharing

General

Target

40ef4e92d2dd01ad889e5d14a6bc48e7_JaffaCakes118
Size

1.2MB
Sample

240514-kxhkaahd8z
MD5

40ef4e92d2dd01ad889e5d14a6bc48e7
SHA1

b3aa5ccafe40dc6555a7e64bf5173b1207d517a0
SHA256

4ea150ff416821c0b65ae4990456126c4912f6745fc720bfc6874b45032908df
SHA512

eaecfea7a30a407f1d21603dba16dc0093dc71649a9547ec43325a71092bfad2401e6b231b418da9db1a4e51eb361ff0e839a23d99f8d0d630aa931987810b35
SSDEEP

24576:t/2wNbW3uw8flnG/kvw+WS3wfPfMcDiGw:Z2wAuw8NnG/qJw/N

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  40ef4e92d2dd01ad889e5d14a6bc48e7_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  40ef4e92d2dd01ad889e5d14a6bc48e7
- SHA1
  
  b3aa5ccafe40dc6555a7e64bf5173b1207d517a0
- SHA256
  
  4ea150ff416821c0b65ae4990456126c4912f6745fc720bfc6874b45032908df
- SHA512
  
  eaecfea7a30a407f1d21603dba16dc0093dc71649a9547ec43325a71092bfad2401e6b231b418da9db1a4e51eb361ff0e839a23d99f8d0d630aa931987810b35
- SSDEEP
  
  24576:t/2wNbW3uw8flnG/kvw+WS3wfPfMcDiGw:Z2wAuw8NnG/qJw/N
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan