nanocore

General

Target

f9ce82903829f5d940db564f58c84d27_JaffaCakes118
Size

202KB
Sample

240927-f7vv5sxdlq
MD5

f9ce82903829f5d940db564f58c84d27
SHA1

4454cf2ac3cdf4c4f9766c471050a6df6b1567a6
SHA256

354fd3500b12f4f9c10b5b8c43c9bddb05e30cad2443f77db91eeb0cda7188b8
SHA512

cca1a4fb7f999d1a751957c3db6798cd6159a3b29c79a6eecf5db2b123d287a0d66f09c651282af440e93930556820ec94f5abe26d000b065f19a0d1412a1743
SSDEEP

3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI6GxB/vHXxTVHgUxECr3UQ+7ZU:gLV6Bta6dtJmakIM5CP/vZxECjUQ+7e

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

paymentmonth.libfoobar.com:8807

paymentrab.sinsincity.com:8807

Mutex

7f839d4f-b30c-4944-af38-85d2ce91bbc0

Attributes

activate_away_mode
true
backup_connection_host
paymentrab.sinsincity.com
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-01-17T14:52:44.069694936Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
8807
default_group
payme
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7f839d4f-b30c-4944-af38-85d2ce91bbc0
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
paymentmonth.libfoobar.com
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  f9ce82903829f5d940db564f58c84d27_JaffaCakes118
- Size
  
  202KB
- MD5
  
  f9ce82903829f5d940db564f58c84d27
- SHA1
  
  4454cf2ac3cdf4c4f9766c471050a6df6b1567a6
- SHA256
  
  354fd3500b12f4f9c10b5b8c43c9bddb05e30cad2443f77db91eeb0cda7188b8
- SHA512
  
  cca1a4fb7f999d1a751957c3db6798cd6159a3b29c79a6eecf5db2b123d287a0d66f09c651282af440e93930556820ec94f5abe26d000b065f19a0d1412a1743
- SSDEEP
  
  3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI6GxB/vHXxTVHgUxECr3UQ+7ZU:gLV6Bta6dtJmakIM5CP/vZxECjUQ+7e
Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2