Overview

overview

10

Static

static

10

test.exe

windows7-x64

10

test.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.exe

  • Size

    202KB

  • Sample

    241029-bd3xfayrfv

  • MD5

    51cca32230f395df5333220a54cd0ea2

  • SHA1

    5b8a00eba80bb7c6edf0261f0ed9ae01c64938d8

  • SHA256

    01ed5393d88cd5f11835b3e7e60cb1c3acaea3674009d5eb56b58599515fe1d6

  • SHA512

    e96f515424408805eb60c86b9438b88111a705b8a1a699d9463b18eee6b44e0d547631de6e1b1abbb02d62d0d598b52ef39e7efc096ef68da0c2a588c64b41d3

  • SSDEEP

    6144:gLV6Bta6dtJmakIM5cEcNr2JvU639Wn2aI:gLV6BtpmkecNr6lNcK

Score
10/10
nanocorediscoveryevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

chinminge.ddns.net:54984

127.0.0.1:54984
Mutex

753bed33-1a32-4b85-99d8-c47db38174c1

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2024-08-10T02:34:19.676275136Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    54984

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    753bed33-1a32-4b85-99d8-c47db38174c1

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    chinminge.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    false

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

MITRE ATT&CK Enterprise v15

Tasks