Overview

overview

10

Static

static

10

NanoCore 1.2.2.0.rar

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NanoCore 1.2.2.0.rar

  • Size

    11.0MB

  • Sample

    241117-zj4ypaybmr

  • MD5

    4538860fa47e6d6ea3271b362004e371

  • SHA1

    c4f632049928aa82d36d932665718c689c86bcf5

  • SHA256

    8c7d7698d6377193d9795727b59475d36cdddea75f525e5468b87c61da68d04e

  • SHA512

    1cbc244a3942394ae960615471a40d3d57a54017ee606e95da4c113f53644ed20e9c0f1e0528e3ed77c172189ac01672fec28e384203f7fe0c62d351f01f89ab

  • SSDEEP

    196608:dxwI8RUUyA1RB2bkj+gegzJowW3Wx0u8CU3ymPhB26kRgJzj1DFeYMRjWcJ:dxmRUUTeOHRSWxsCU33nMGMRDJ

Score
10/10
nanocorediscoveryexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      NanoCore 1.2.2.0.rar

    • Size

      11.0MB

    • MD5

      4538860fa47e6d6ea3271b362004e371

    • SHA1

      c4f632049928aa82d36d932665718c689c86bcf5

    • SHA256

      8c7d7698d6377193d9795727b59475d36cdddea75f525e5468b87c61da68d04e

    • SHA512

      1cbc244a3942394ae960615471a40d3d57a54017ee606e95da4c113f53644ed20e9c0f1e0528e3ed77c172189ac01672fec28e384203f7fe0c62d351f01f89ab

    • SSDEEP

      196608:dxwI8RUUyA1RB2bkj+gegzJowW3Wx0u8CU3ymPhB26kRgJzj1DFeYMRjWcJ:dxmRUUTeOHRSWxsCU33nMGMRDJ

    Score
    10/10
    nanocorediscoveryexecutionkeyloggerpersistencespywarestealertrojan

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Nanocore family

      nanocore

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks