nanocore

General

Target

7c1ff03d7f14a5eabd43873bb4971b5f_JaffaCakes118
Size

1.1MB
Sample

240731-mzd1zstfpd
MD5

7c1ff03d7f14a5eabd43873bb4971b5f
SHA1

aca8440bef0d1b53d7b7396f7cb6b44891d4e9ef
SHA256

d84feff4c109ae89c3712afd4454ec8a2e9171930cee71d665fd7bbe705b095e
SHA512

e6d79aafc34567dc6057db11194bc6fcf9012e2eeb0373f695507339f05ca20ae8f5bf4460976d7f38731546110cfdd9798c883238f3ecaba37b07a63f7552fd
SSDEEP

12288:BWFOi0F6iNhOFpzx1Bw1regn1cBMBN0B/DXH2qqewGOqzDAMOnYyniZYUg0Jx59B:Ewi0ZhOFpzx3UBgD3hqe/OqzsnvG5

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

queda2122.ddns.net:110

queda212.ddns.net:110

Mutex

a59769ae-d88b-48a6-9aeb-eba13186dd16

Attributes

activate_away_mode
true
backup_connection_host
queda212.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-05-01T17:12:48.076145036Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
110
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
a59769ae-d88b-48a6-9aeb-eba13186dd16
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
queda2122.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  7c1ff03d7f14a5eabd43873bb4971b5f_JaffaCakes118
- Size
  
  1.1MB
- MD5
  
  7c1ff03d7f14a5eabd43873bb4971b5f
- SHA1
  
  aca8440bef0d1b53d7b7396f7cb6b44891d4e9ef
- SHA256
  
  d84feff4c109ae89c3712afd4454ec8a2e9171930cee71d665fd7bbe705b095e
- SHA512
  
  e6d79aafc34567dc6057db11194bc6fcf9012e2eeb0373f695507339f05ca20ae8f5bf4460976d7f38731546110cfdd9798c883238f3ecaba37b07a63f7552fd
- SSDEEP
  
  12288:BWFOi0F6iNhOFpzx1Bw1regn1cBMBN0B/DXH2qqewGOqzDAMOnYyniZYUg0Jx59B:Ewi0ZhOFpzx3UBgD3hqe/OqzsnvG5
Score

10^/10

discovery nanocore evasion keylogger spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Drops startup file
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Drops startup file

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2