Overview

overview

10

Static

static

3

c01ed28282...18.exe

windows7-x64

10

c01ed28282...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118

  • Size

    337KB

  • Sample

    240825-gyctmszhrp

  • MD5

    c01ed28282861c64c111d5f7d82d7d59

  • SHA1

    503912d7b071ad737435b4643584c9275d71c660

  • SHA256

    ba035935071e8273e8e1a3ca9a1d6760a5729b5f8d6abd8cec203ec9c31f1e3b

  • SHA512

    f93551058e41394f86ed47f18981fdf412703ca7bb20296953ba52566995ae08807cb53a4343dba842ad5ab0f8973be6ac9609e2384db33de93c1cb15e8a56c2

  • SSDEEP

    6144:jSBLT/md6cavIzW+jT0SPM0OT3v/MjYRAtZ6yTsaMDSjLF:js/S6cH1T0sMDbk8aMymD

Score
10/10
nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.227.83.51:2019

abujafirms.ddns.net:2019
Mutex

38bf781e-b7d8-473f-9d3b-d158d61dbf9a

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    abujafirms.ddns.net

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2018-01-29T00:57:38.184134936Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    2019

  • default_group

    Bestfoods 19

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    38bf781e-b7d8-473f-9d3b-d158d61dbf9a

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    185.227.83.51

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118

    • Size

      337KB

    • MD5

      c01ed28282861c64c111d5f7d82d7d59

    • SHA1

      503912d7b071ad737435b4643584c9275d71c660

    • SHA256

      ba035935071e8273e8e1a3ca9a1d6760a5729b5f8d6abd8cec203ec9c31f1e3b

    • SHA512

      f93551058e41394f86ed47f18981fdf412703ca7bb20296953ba52566995ae08807cb53a4343dba842ad5ab0f8973be6ac9609e2384db33de93c1cb15e8a56c2

    • SSDEEP

      6144:jSBLT/md6cavIzW+jT0SPM0OT3v/MjYRAtZ6yTsaMDSjLF:js/S6cH1T0sMDbk8aMymD

    Score
    10/10
    nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks