nanocore

Sharing

Copy URL

Twitter E-mail

General

Target

e411826dbcbcbfbcb5bc9522eee3401f_JaffaCakes118
Size

507KB
Sample

240916-fpc8dazele
MD5

e411826dbcbcbfbcb5bc9522eee3401f
SHA1

de820d9ff91616dd6ffbf91c88a44e35601d216c
SHA256

6365674917c2e0b65ae5e5e8609e7ca2287b7ae47fba084c2514315eaacdfd5f
SHA512

09050326fbc0bc61a327a6696f8176a1f351917c1ec3daf06106fea27eab9a087f2214b54fb93a5e3b8e42cdf2546871a30be7c3f804a8a4f3535fcf05e81a20
SSDEEP

12288:OeH1L7KifEh2+jL85PpxiyOpDPffLNgL6TMC5KRaaUlNk:Os2ifEU+exiJNPXaLCXlNk

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

46.243.189.131:8765

Mutex

7fe807b8-5584-4b51-9d61-c97d8e699fb3

Attributes

activate_away_mode
false
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-07-12T15:41:04.289187136Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8765
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7fe807b8-5584-4b51-9d61-c97d8e699fb3
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
46.243.189.131
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  Draft-Contract - QT-ACR-VAV #2018105.scr
- Size
  
  593KB
- MD5
  
  88bc51002102a5856ca65303653457ee
- SHA1
  
  328f04ff3ceabd77bb45d9e6a85b3bf1472768ae
- SHA256
  
  5f87086ab87b2eb8d0cff4b0776d062d071e5369c28ba07cea2fb8e99e833dce
- SHA512
  
  8d9abdc8477867bcae148b3a66db8a1c61d0e0e009cc117c0a3c420ca10ee68935f7308cdcee764bc63028db506defd81afc1828121e34c92c373974ad00e95a
- SSDEEP
  
  12288:hzYnKOlBR73fB4G/Lt3MsqfZsViWpjj4JNfiTEbW5gqtcL/Eh0/UIWu/gq:lKKI7SGz5/qfej4viyWKqtcoiX
Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2