General

  • Target

    aa.exe

  • Size

    202KB

  • Sample

    240929-v9ygdaxcqf

  • MD5

    ff2a52bb3dc9b6b725e725ab64ee2a4f

  • SHA1

    78176de490ef034c8d3e9fd47682c8d1388be486

  • SHA256

    3a7b3e8f648eef95b7eb3a702d6d5e3dc02c3071837fbcd9f10e06881e4b8022

  • SHA512

    8f6d7ae22d8b59876b845d2013f4b6a9ffa5f6a5785d964faf9fb5d06955483787fe669177d1f9787b68596e58395fa4c81a1fcbdfe902f9aab26d76ba09f98e

  • SSDEEP

    3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIRtPl1W4F0MpeCWBxwEJce:gLV6Bta6dtJmakIM5KlY4yMpeCoxwET

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

2.tcp.eu.ngrok.io:10394

/2.tcp.eu.ngrok.io:10394

Mutex

71d32398-48a9-4b06-bdce-e0c1af26ee18

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    /2.tcp.eu.ngrok.io

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2024-07-11T13:07:12.297681036Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    10394

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    71d32398-48a9-4b06-bdce-e0c1af26ee18

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    2.tcp.eu.ngrok.io

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      aa.exe

    • Size

      202KB

    • MD5

      ff2a52bb3dc9b6b725e725ab64ee2a4f

    • SHA1

      78176de490ef034c8d3e9fd47682c8d1388be486

    • SHA256

      3a7b3e8f648eef95b7eb3a702d6d5e3dc02c3071837fbcd9f10e06881e4b8022

    • SHA512

      8f6d7ae22d8b59876b845d2013f4b6a9ffa5f6a5785d964faf9fb5d06955483787fe669177d1f9787b68596e58395fa4c81a1fcbdfe902f9aab26d76ba09f98e

    • SSDEEP

      3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIRtPl1W4F0MpeCWBxwEJce:gLV6Bta6dtJmakIM5KlY4yMpeCoxwET

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.