nanocore | 471e18398a263a1c7910c28473e27b0f0dc1286f9f37a61a073b3e3251d9b4b7 | Triage

Sharing

General

Target

8ce7cd957aeaa673f0f07dca1118382d_JaffaCakes118
Size

260KB
Sample

240602-e8rdnsbg76
MD5

8ce7cd957aeaa673f0f07dca1118382d
SHA1

bb63988ef5fb54c272e8799186278aa5f4ebcf1d
SHA256

471e18398a263a1c7910c28473e27b0f0dc1286f9f37a61a073b3e3251d9b4b7
SHA512

f69969b798f8949471fdd19476c1d04e09b51c7e440a3e2cee9157ea736b17df20d330ee2315b4bbac2790a60ae722323d3746636129a2001e6997328f2e8e50
SSDEEP

3072:azBdczMXSLFsnDTIKjVAPz4UqKBWfN4DB7eUM3dKnoJvCvlnr92DEbnRiu1WDs:aTXSLGnDMRP1qxlqB7i3dOopCvtYqp1

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  8ce7cd957aeaa673f0f07dca1118382d_JaffaCakes118
- Size
  
  260KB
- MD5
  
  8ce7cd957aeaa673f0f07dca1118382d
- SHA1
  
  bb63988ef5fb54c272e8799186278aa5f4ebcf1d
- SHA256
  
  471e18398a263a1c7910c28473e27b0f0dc1286f9f37a61a073b3e3251d9b4b7
- SHA512
  
  f69969b798f8949471fdd19476c1d04e09b51c7e440a3e2cee9157ea736b17df20d330ee2315b4bbac2790a60ae722323d3746636129a2001e6997328f2e8e50
- SSDEEP
  
  3072:azBdczMXSLFsnDTIKjVAPz4UqKBWfN4DB7eUM3dKnoJvCvlnr92DEbnRiu1WDs:aTXSLGnDMRP1qxlqB7i3dOopCvtYqp1
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan