General

  • Target

    fc4be56565a028b5951a712d02ffc543_JaffaCakes118

  • Size

    700KB

  • Sample

    240928-pmxcxaycld

  • MD5

    fc4be56565a028b5951a712d02ffc543

  • SHA1

    20c1df245e681f90ab151e88aa5897aa3df51218

  • SHA256

    d601e0e786396579498c7f143d9a3dd18c1b094acb54208781e5a0a93630e810

  • SHA512

    30aa17280be5ab75d8bbafe5e4588b3e2d30b053f63fd68f35cc4790c8e69c4a154556023ad9c74881c9773d727c66305f7bd39c5cd82fef91ac101c8a75a0f9

  • SSDEEP

    6144:OlUUm/cPUQ5BjRr9pu0g0U8EeJgDv7EC3Zhvm2dJXJLX8kGekn1YdEzp8GS:6UB/CB9r9kWJGvDpN/dTQ1C+PS

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

frankwill12.ddns.net:3940

194.5.99.22:3940

Mutex

e6db2617-daec-4b7c-8707-82756be39dc9

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    194.5.99.22

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2018-08-05T17:26:41.905670736Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    3940

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    e6db2617-daec-4b7c-8707-82756be39dc9

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    frankwill12.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      fc4be56565a028b5951a712d02ffc543_JaffaCakes118

    • Size

      700KB

    • MD5

      fc4be56565a028b5951a712d02ffc543

    • SHA1

      20c1df245e681f90ab151e88aa5897aa3df51218

    • SHA256

      d601e0e786396579498c7f143d9a3dd18c1b094acb54208781e5a0a93630e810

    • SHA512

      30aa17280be5ab75d8bbafe5e4588b3e2d30b053f63fd68f35cc4790c8e69c4a154556023ad9c74881c9773d727c66305f7bd39c5cd82fef91ac101c8a75a0f9

    • SSDEEP

      6144:OlUUm/cPUQ5BjRr9pu0g0U8EeJgDv7EC3Zhvm2dJXJLX8kGekn1YdEzp8GS:6UB/CB9r9kWJGvDpN/dTQ1C+PS

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.