nanocore

General

Target

f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118
Size

792KB
Sample

240925-dm7cbs1gjj
MD5

f50a221ffb7eb3641ebf3f3be8630f63
SHA1

3cddb6a3baea846b7a02de2796fab42a0c14f05f
SHA256

141fb77e52e888c7b37e5e3a8d8f07a7858a71430da0daa4563088adae1064db
SHA512

df37e56c9937806b675e48d28c6555454e7bf25b587c8db56b51a1af593a45bdc7aca39dcbd5bd02428f4c9fc3712a46a92c178a32457a7c27cde7fb325c0baa
SSDEEP

24576:gNR2zaQBt37/CZ0w1PeWnzqhqCC6+PEhd:FUsrC6aEL

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

Prince.jumpingcrab.com:1223

185.125.205.90:1223

Mutex

931b30f5-34a9-4550-be3d-24ac3ab0a06d

Attributes

activate_away_mode
true
backup_connection_host
185.125.205.90
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-08-10T02:52:49.622793536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1223
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
931b30f5-34a9-4550-be3d-24ac3ab0a06d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
Prince.jumpingcrab.com
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  f50a221ffb7eb3641ebf3f3be8630f63_JaffaCakes118
- Size
  
  792KB
- MD5
  
  f50a221ffb7eb3641ebf3f3be8630f63
- SHA1
  
  3cddb6a3baea846b7a02de2796fab42a0c14f05f
- SHA256
  
  141fb77e52e888c7b37e5e3a8d8f07a7858a71430da0daa4563088adae1064db
- SHA512
  
  df37e56c9937806b675e48d28c6555454e7bf25b587c8db56b51a1af593a45bdc7aca39dcbd5bd02428f4c9fc3712a46a92c178a32457a7c27cde7fb325c0baa
- SSDEEP
  
  24576:gNR2zaQBt37/CZ0w1PeWnzqhqCC6+PEhd:FUsrC6aEL
Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2