nanocore

Sharing

Copy URL

Twitter E-mail

General

Target

54a2b3e8a16feb53c082300d5a2b5d8c45f8d04fed6c6e8a7b5a296f9a96f945
Size

933KB
Sample

241105-q457tashnp
MD5

58d7e50a6b8e2a78b2bc749af46fd68d
SHA1

7993e321df2fc1f6ace30245186c1d12635debb9
SHA256

54a2b3e8a16feb53c082300d5a2b5d8c45f8d04fed6c6e8a7b5a296f9a96f945
SHA512

2253958c2cb9885f2d2c8408c978233f732dade69e640d771fc635bf3a0e954c64d082ebda459a4ba2d108822fb9ded9b8d51c406b8d83bff6fa20ddf784d319
SSDEEP

24576:G01zyM8w5BqgIs9JfnrCCPSm/0jCgZczbj8n:R1zy1w5HIs9prCCP2mgezfG

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

185.222.58.53:9805

Mutex

4a272282-28bb-4f35-9d1f-fa3fe895120e

Attributes

activate_away_mode
true
backup_connection_host
185.222.58.53
backup_dns_server
185.222.58.53
buffer_size
65535
build_time
2024-08-16T02:14:15.372206536Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9805
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
4a272282-28bb-4f35-9d1f-fa3fe895120e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
185.222.58.53
primary_dns_server
185.222.58.53
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  CHEQUE.exe
- Size
  
  1.3MB
- MD5
  
  6f3602ab7ad8432de871e02c49588bbe
- SHA1
  
  21c93399f0cb022e643c3dd1ae60e388d1812b14
- SHA256
  
  ea3b8bd5f61d3ac3f8b7b2fcd90c0f7caaa36bb9435207748230753031cc3cf1
- SHA512
  
  4ec33dea1126796d77afeb27268e73313c69ca759267a7d935674082b9a785a754094bd4de50246be1bccd9211da401906e4801504bce8be092688e15c92f50e
- SSDEEP
  
  24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8aBjJrC4V+4/U3g+XO7bjW:QTvC/MTQYxsWR7aBjxC4VCQ++7f
Score

10^/10

nanocore discovery keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Nanocore family
  nanocore
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2