General

  • Target

    9f51d9fa2d90c6185f9d6ccce80ce773cd2b9658e4e93e4aa938c705c3c38fc3

  • Size

    413KB

  • Sample

    240926-xqgevswbrh

  • MD5

    18ba7739fbe43f651f783c79b7562fb3

  • SHA1

    28d64c6563bc7bf2d2cdaa6b137eab15de743c1f

  • SHA256

    9f51d9fa2d90c6185f9d6ccce80ce773cd2b9658e4e93e4aa938c705c3c38fc3

  • SHA512

    b34b8b82486aeb3c9e8611b14bfbc6cf2cb86b1f2f867b70e6921764ab56c2de6d446012e3b5ff9b4c8ca16ed0eb25ef53554f6744e1bb0947f42a18a6a36a20

  • SSDEEP

    6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RUe:ITNYrnE3bm/CiejewY5vF

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

asporturizm@ddns.net:46218

178.32.224.116:46218

Mutex

4af74541-e3f1-469c-8af7-efe4071b81cf

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    178.32.224.116

  • backup_dns_server

  • buffer_size

    65535

  • build_time

    2018-07-28T12:59:38.488799236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    46218

  • default_group

    tourex

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    4af74541-e3f1-469c-8af7-efe4071b81cf

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    asporturizm@ddns.net

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      9f51d9fa2d90c6185f9d6ccce80ce773cd2b9658e4e93e4aa938c705c3c38fc3

    • Size

      413KB

    • MD5

      18ba7739fbe43f651f783c79b7562fb3

    • SHA1

      28d64c6563bc7bf2d2cdaa6b137eab15de743c1f

    • SHA256

      9f51d9fa2d90c6185f9d6ccce80ce773cd2b9658e4e93e4aa938c705c3c38fc3

    • SHA512

      b34b8b82486aeb3c9e8611b14bfbc6cf2cb86b1f2f867b70e6921764ab56c2de6d446012e3b5ff9b4c8ca16ed0eb25ef53554f6744e1bb0947f42a18a6a36a20

    • SSDEEP

      6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RUe:ITNYrnE3bm/CiejewY5vF

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.