Overview

overview

10

Static

static

3

fb81dbb936...2c.exe

windows7-x64

10

fb81dbb936...2c.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    635980b7987a66efcf6f999a545ea6df8b53ee0953a9c4f8fdb15cadea631223

  • Size

    379KB

  • Sample

    240901-nt22aszenf

  • MD5

    e832947294d650c68de0068771eafe1a

  • SHA1

    35c39c318b85be2e407fe34a01d26a475e428766

  • SHA256

    635980b7987a66efcf6f999a545ea6df8b53ee0953a9c4f8fdb15cadea631223

  • SHA512

    810c468cdfa06882fbbe46f9bffd013a88b5fd0cb4c25a1e14a074a60205f5d143c4f920239f6acbbc5ee7fc419d387eeeb80d3af325158bf8cf40512cc35235

  • SSDEEP

    6144:Uq48WYhI/+GT29UbmrAm/LskiUl2LRUOaXxbM37jrnLTm4aCzrqfEnybuPrDkxkk:H6cWK9UbK/Ls/V6+jnLYCiMnybuPrAxj

Score
10/10
nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

kamuchehddhgfgf.ddns.net:1187

37.0.10.22:1187
Mutex

9ff0e8a4-a323-4111-bc49-0daecb63120d

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    37.0.10.22

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-07-17T00:05:39.048278936Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    1187

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    9ff0e8a4-a323-4111-bc49-0daecb63120d

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    kamuchehddhgfgf.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      fb81dbb936499b8c5f5aaa64be8e36f964bae687f03298eff7e856c3ac0ea22c

    • Size

      435KB

    • MD5

      80ff3feac7e5fcfff6368bbd5cfa2ae5

    • SHA1

      b1d508b386409cbb6b6ffe94e8f25db1a02f00ff

    • SHA256

      fb81dbb936499b8c5f5aaa64be8e36f964bae687f03298eff7e856c3ac0ea22c

    • SHA512

      4e353d5356826f1021ee33dd3d55b46ba03cf246bf0c58ebccfcbb597aaf0ddda11360808e9901f9c154ad79fe2c127b559c1c2b2d41b01a1989d002d7602a84

    • SSDEEP

      6144:GlYiFRIM4/8C6uJk07oQ2g+pYSa1/Fe+y0QWSoWQx4sahloJ/vcFTHV4dBJ:GCinIMMH6uNooYB0RnCJDoJ/0FT1E

    Score
    10/10
    nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks