nanocore

General

Target

TRANSACTION PROOF 2930-043894.scr.exe
Size

463KB
Sample

240723-tyk68s1hrh
MD5

d440a009fdf2f597cc37dd26baa95305
SHA1

6e7f39197bbb705715b435fdb988bf0996384736
SHA256

38f9027db5db0e80bf54fd0b58834c4e41832fcb5823de688e73b8729c320252
SHA512

2c574ef847febb7c5dc6f29af9ade92cf70ac615faa670828ebdecf46e7e3f4d181ced426201c1a05eafa747f9bd01dad490284cbfc8b45b75eb898d266ffd42
SSDEEP

6144:ZhjmMV+zyoFd/Lt00Gf5PW9kifgJaS+Xkk0G0njdQl1PQpZisyt9a0:pAzFd/Ltof5BtaS+XkXGeQl1EZfA

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

multipleentry90dayscontroller.homingbeacon.net:54980

Mutex

6df769ca-fa90-4d27-be6c-663c699e6628

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2023-07-28T11:56:28.201018636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
54980
default_group
K59
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
6df769ca-fa90-4d27-be6c-663c699e6628
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
multipleentry90dayscontroller.homingbeacon.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  TRANSACTION PROOF 2930-043894.scr.exe
- Size
  
  463KB
- MD5
  
  d440a009fdf2f597cc37dd26baa95305
- SHA1
  
  6e7f39197bbb705715b435fdb988bf0996384736
- SHA256
  
  38f9027db5db0e80bf54fd0b58834c4e41832fcb5823de688e73b8729c320252
- SHA512
  
  2c574ef847febb7c5dc6f29af9ade92cf70ac615faa670828ebdecf46e7e3f4d181ced426201c1a05eafa747f9bd01dad490284cbfc8b45b75eb898d266ffd42
- SSDEEP
  
  6144:ZhjmMV+zyoFd/Lt00Gf5PW9kifgJaS+Xkk0G0njdQl1PQpZisyt9a0:pAzFd/Ltof5BtaS+XkXGeQl1EZfA
Score

10^/10

nanocore discovery evasion execution keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1
- Target
  
  lbkefhzm.exe
- Size
  
  194KB
- MD5
  
  df94c0e13e9170afcde2c5fed16a3600
- SHA1
  
  1190674c6027614ba60ae23d44f469707ec500fc
- SHA256
  
  2610d8a1362ee28e59bc811d63e8d5c63e6021f94635be9a6c0921c6e62c98b2
- SHA512
  
  85a0ff0bf2824ac55430dddf967a02ebfc9145159255b148cced9aafc277b66dbc02fad97270fcb7b96a81b378a14ebd10d642884f05347b6278a5f6025a98f0
- SSDEEP
  
  3072:yDM3BbjHUffrVYDdJuNFS+gwRiz+iGxKmlGsEgSYRIuAg0FujwZ3UMk53:yDIKr0Pu7SPy4+i3MAOGI3
Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral2