Overview

overview

10

Static

static

1

fde8282375...18.exe

windows7-x64

10

fde8282375...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fde8282375e05abfe74836501420cedc_JaffaCakes118

  • Size

    596KB

  • Sample

    240929-gf38wavbqh

  • MD5

    fde8282375e05abfe74836501420cedc

  • SHA1

    55040e65849b1db2f0896d8f9c217df403bd1414

  • SHA256

    e1fb99632bcd95f1eae332e7eac7ae029202a811fbfa61c3ae1aee26bc8380cf

  • SHA512

    668aac816a90b44cb414342757f55dac40a68ea43cad1f041500da9760cfb092380cb3bc1a305200d0ce3188a745b5ab1fd279fcc30fa78e3b0b6e0ce2d3e985

  • SSDEEP

    12288:J09zLV1jkNgGkXnI6md1AxL7uhENNoeZbc:MLnygGIIt1CM8NoeZw

Score
10/10
nanocorediscoveryevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

95.141.43.200:1980

127.0.0.1:1980
Mutex

1998f293-b23b-4226-862e-f71163d89e98

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2018-08-17T11:30:51.231187236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    1980

  • default_group

    November 5

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    1998f293-b23b-4226-862e-f71163d89e98

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    95.141.43.200

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      fde8282375e05abfe74836501420cedc_JaffaCakes118

    • Size

      596KB

    • MD5

      fde8282375e05abfe74836501420cedc

    • SHA1

      55040e65849b1db2f0896d8f9c217df403bd1414

    • SHA256

      e1fb99632bcd95f1eae332e7eac7ae029202a811fbfa61c3ae1aee26bc8380cf

    • SHA512

      668aac816a90b44cb414342757f55dac40a68ea43cad1f041500da9760cfb092380cb3bc1a305200d0ce3188a745b5ab1fd279fcc30fa78e3b0b6e0ce2d3e985

    • SSDEEP

      12288:J09zLV1jkNgGkXnI6md1AxL7uhENNoeZbc:MLnygGIIt1CM8NoeZw

    Score
    10/10
    nanocorediscoveryevasionkeyloggerspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks