General
-
Target
free fud crypter.exe
-
Size
325KB
-
Sample
240805-wfxhnaxcpb
-
MD5
b17882b54edb3b3bd1f4f717f2062b2a
-
SHA1
550f55477a33d6099a5570a01ff9ac34ff4fa7b8
-
SHA256
8b9f7a10b753f412b15ddf92cbc58e3b3ef6b8adcb10bd56c2596d284af3db57
-
SHA512
8cd3ddb7014224c65c8d033d0da8cb9d43a631950b89185d2027ac2d82b028b0425193e7f2a3f47ef420064bddf3b1544d979117f45e3097a37b14c46f14a263
-
SSDEEP
6144:GLV6Bta6dtJmakIM5VXINTT8LgAFAl7R9uics8A5ELiUfoH:GLV6BtpmkxT2GRVcs8ASPW
Malware Config
Extracted
nanocore
1.2.2.0
62.143.14.73:54984
d0723f68-196e-49f1-b4d9-d1ab1d7e1d59
-
activate_away_mode
true
-
backup_connection_host
62.143.14.73
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-05-17T19:32:15.893428836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
d0723f68-196e-49f1-b4d9-d1ab1d7e1d59
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
62.143.14.73
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
free fud crypter.exe
-
Size
325KB
-
MD5
b17882b54edb3b3bd1f4f717f2062b2a
-
SHA1
550f55477a33d6099a5570a01ff9ac34ff4fa7b8
-
SHA256
8b9f7a10b753f412b15ddf92cbc58e3b3ef6b8adcb10bd56c2596d284af3db57
-
SHA512
8cd3ddb7014224c65c8d033d0da8cb9d43a631950b89185d2027ac2d82b028b0425193e7f2a3f47ef420064bddf3b1544d979117f45e3097a37b14c46f14a263
-
SSDEEP
6144:GLV6Bta6dtJmakIM5VXINTT8LgAFAl7R9uics8A5ELiUfoH:GLV6BtpmkxT2GRVcs8ASPW
Score10/10-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Adds Run key to start application
-
Checks whether UAC is enabled
-