General

  • Target

    70d75f0f3b96abff1102708b5454b622a2aba1b0738fe0f57362ecea2bf6a04dN

  • Size

    413KB

  • Sample

    241006-3j7alasdjn

  • MD5

    a39d23eb09d78a27fa593c0a133e72b0

  • SHA1

    a2204e577cbff135f4970226a29d495572d1f491

  • SHA256

    70d75f0f3b96abff1102708b5454b622a2aba1b0738fe0f57362ecea2bf6a04d

  • SHA512

    fda5a430140cd355b1dfa93fd0a9aa151db014a44aa6b244e39c5e743924bb697e6782c901c702e84ad93c8ac70ef866ca458e2ac0533a340e64c82356e1628d

  • SSDEEP

    6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RUf:ITNYrnE3bm/CiejewY5vQ

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

asporturizm@ddns.net:46218

178.32.224.116:46218

Mutex

4af74541-e3f1-469c-8af7-efe4071b81cf

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    178.32.224.116

  • backup_dns_server

  • buffer_size

    65535

  • build_time

    2018-07-28T12:59:38.488799236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    46218

  • default_group

    tourex

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    4af74541-e3f1-469c-8af7-efe4071b81cf

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    asporturizm@ddns.net

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      70d75f0f3b96abff1102708b5454b622a2aba1b0738fe0f57362ecea2bf6a04dN

    • Size

      413KB

    • MD5

      a39d23eb09d78a27fa593c0a133e72b0

    • SHA1

      a2204e577cbff135f4970226a29d495572d1f491

    • SHA256

      70d75f0f3b96abff1102708b5454b622a2aba1b0738fe0f57362ecea2bf6a04d

    • SHA512

      fda5a430140cd355b1dfa93fd0a9aa151db014a44aa6b244e39c5e743924bb697e6782c901c702e84ad93c8ac70ef866ca458e2ac0533a340e64c82356e1628d

    • SSDEEP

      6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RUf:ITNYrnE3bm/CiejewY5vQ

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.