Overview

overview

10

Static

static

5

COVID-19 V...le.exe

windows7-x64

10

COVID-19 V...le.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb3333ee36d0cda5a9fb458d990faae4_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240928-a6r5za1akc

  • MD5

    fb3333ee36d0cda5a9fb458d990faae4

  • SHA1

    9aa198dafb84de1c3583f79341a470ff8ff12894

  • SHA256

    a5b286098fc58daf89e3f657c9af4472c9d991c62f48350202171878474ca5dd

  • SHA512

    f4b346ba08fc737eb58e13a9fa2e93731b82a10ca65b3403feeb7ec3f3342430da67a2b68458784dd617a4057a9dd6479713a143df8fde4658a31691469344b5

  • SSDEEP

    24576:fb9Eyxn6HqtZKxK8TVG3E6kM9mY+l28pU/h96dR+Q2ituuTS6ifx68j:j9Png2ATTI3Eokl2T9kR+vEFTS6etj

Score
10/10
nanocorediscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

185.140.53.161:2404

Mutex

42616936-d942-4900-bde0-8c61d205ad87

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-01-16T21:35:27.028614736Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    2404

  • default_group

    COVID

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    42616936-d942-4900-bde0-8c61d205ad87

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    185.140.53.161

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      COVID-19 Vaccine Sample.exe

    • Size

      1.6MB

    • MD5

      91870ccc3bfca2f49ced895e28ae1844

    • SHA1

      5ba817e16623c79605ed923033f1ff74633c075f

    • SHA256

      a88612acfb81cf09772f6bc9d0dccca8c8d5569ea73148e1e6d1fe0381fe5aec

    • SHA512

      e88c7d313a017fb51ac933818845594bdd29dfd9ab1a7d3d7c04742104ae74217e190231c25711bbfb63fa3df32a858e01c4cc435e4d35e0657bdcef15797aa4

    • SSDEEP

      24576:LCdxte/80jYLT3U1jfsWaij0xEVEFxxOWHwRMODKjidxuVxdquBW0PkDpCX2rkTQ:Cw80cTsjkWaidWHOKjDx5BvP2k2rV

    Score
    10/10
    nanocorediscoverykeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks