nanocore

Sharing

Copy URL

Twitter E-mail

General

Target

29082024_1533_Docs_27109265_20242908_SHT0178727_MALAYSIA-8135621.Pdf.bz
Size

596KB
Sample

240829-szbhrayfkh
MD5

49b76e4d8f9edf183bde3779da7f93e1
SHA1

8be02a91add13c6153c24ceed604d7df192896b5
SHA256

20227224e2f655123f1fac78b075fd9b411b60bd1092aecf998dd05c4fb8b868
SHA512

dd19052319b2d046210e722d70c7a9cdb9563d159b1eb1c82200c88b79354f9b41bacc233b4dec0d39f95784bc94cb4e14773278c690e021fc55bf01668f2c40
SSDEEP

12288:bkaMUtFXZ9bwm9PRWFfjNjCxjL5lij53155wJk+qjil32mrbzNFqyyg6M7Wj7JN:F/XHbBQFJueKoji/bhwyygeD

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

134.19.179.203:29855

Mutex

f391c720-5b2c-4d20-8ea0-f44d68448759

Attributes

activate_away_mode
true
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-06-08T04:16:49.882921136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
29855
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f391c720-5b2c-4d20-8ea0-f44d68448759
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
134.19.179.203
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  Docs_27109265_20242908_SHT0178727_MALAYSIA-8135621.scr
- Size
  
  715KB
- MD5
  
  87ef7a916c6fa5f38318eea94ca00425
- SHA1
  
  6543412b7492cd9b5cad328d2f8fbd346e18e52f
- SHA256
  
  81d75d4d1dbd3efb6ef4b293968359b8fa4d2e994efa15e16fd368dc73f6d5f7
- SHA512
  
  89e721bd2c0345001e2a3ba8cb4aeeec230bcd1fb239ce449f54fc619dfbd12c828cd46ccc141ffeb59a75a4ae187f5d2c87b83d0e513fdfde71e2a5394bc094
- SSDEEP
  
  12288:RR4ZJht5WuZL5U60qzXp6syn8QgDEF7Gn2nO24twwb8Rb+lPXCswf4hNuV0Z:PWlv+nngoF7m2nOH2wb8qCsSyNueZ
Score

10^/10

nanocore discovery execution keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/Banner.dll
- Size
  
  4KB
- MD5
  
  e4de3a9ebc9544acac3086b523bc0eb5
- SHA1
  
  77d233b728fa85261cec658902bcda37841475fe
- SHA256
  
  da12306600cd7a9e05ed905639f642b21c2cf8b5b9c6983e4146731e20bea7fe
- SHA512
  
  b1c0ac9e97e990d77479ff2fc3f9f37f4a4a575c6b90a602f075a3b98886b6575bf4aaf63e7c9bb03b8d1dfa4b9b90f75ed1c818700e0e6c873b7aa93c35c7de
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/BgImage.dll
- Size
  
  7KB
- MD5
  
  fc8c3be4dae47b4455c51dd211bd4c8c
- SHA1
  
  8d4c35b48d38514c39a1d70a2e8b686268dbdbf1
- SHA256
  
  3aebbbfc55112d4ed18a2335a801a0ad95ad8431ebb65b51ed4184ec671e4f16
- SHA512
  
  11336e2a92044be6c0b87dacf93aca7077fb412996417dc9f263802e1bb47eb457430f1c2d5763cdbf918a043dce5dbd0b75675a14518ce07235ca6f8619ddee
- SSDEEP
  
  96:8eRk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTT4j7J3kWyy/:t2TJa2roqJyA2EN8diuTkje
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  300f88dca54ad92f644fda1a45fcfd80
- SHA1
  
  0434032f7710071a427969d44e46ea764101bd09
- SHA256
  
  9ba14f57d823cce242936e29a36034945f1739f00468712acb641e2e2eb914d9
- SHA512
  
  99846533c77a6047a7626f5dc81064eae2193072858df968e7ff0d9b2462cbd16d6c7791f5f43cb9f539614dfe62127c08405b7f40b41830075d7a019c81a62d
- SSDEEP
  
  192:oK8cSzvTyl4tgi8pPjQM0PuAg0YNyAIFtSP:vBSzm+t18pZ0WAg0RAIFg
Score

3^/10

discovery
behavioral7 behavioral8