nanocore

General

Target

6EBE30726B851619E4F0D8762B09470D.exe
Size

772KB
Sample

241129-gtqvpsvpen
MD5

6ebe30726b851619e4f0d8762b09470d
SHA1

9e84211962e9b46d7d09286213b808b6d614b326
SHA256

03f869fc2438617cbd973ac052b07fdef9b3f5d67e0df12a2e43307b6c477db0
SHA512

f87d30f94423d8a2d62ebaa6b701218c98350cd899b0532d350987c750df26cf83e9d6452890b15c4ae8e2bcba25813ed53fa62a044d22571f926c63a45962d8
SSDEEP

12288:qYCjROpcK2rLeDU+qcHwOsq5GRG+LrB38nq2YgNTCpCjFZg:qYCVOpJ2rLAj3VsXR9HBQNT7j/g

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

alertt.duckdns.org:6445

Mutex

d046c01c-51f5-4c8c-b5b9-b566d533dece

Attributes

activate_away_mode
true
backup_connection_host
alertt.duckdns.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-11-18T08:12:48.987215636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
6445
default_group
RollingStone
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
d046c01c-51f5-4c8c-b5b9-b566d533dece
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
alertt.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  6EBE30726B851619E4F0D8762B09470D.exe
- Size
  
  772KB
- MD5
  
  6ebe30726b851619e4f0d8762b09470d
- SHA1
  
  9e84211962e9b46d7d09286213b808b6d614b326
- SHA256
  
  03f869fc2438617cbd973ac052b07fdef9b3f5d67e0df12a2e43307b6c477db0
- SHA512
  
  f87d30f94423d8a2d62ebaa6b701218c98350cd899b0532d350987c750df26cf83e9d6452890b15c4ae8e2bcba25813ed53fa62a044d22571f926c63a45962d8
- SSDEEP
  
  12288:qYCjROpcK2rLeDU+qcHwOsq5GRG+LrB38nq2YgNTCpCjFZg:qYCVOpJ2rLAj3VsXR9HBQNT7j/g
Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Nanocore family
  nanocore
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  whutenyh.exe
- Size
  
  130KB
- MD5
  
  61797f40c55bf5a11a053fd14d634ff0
- SHA1
  
  b65974ee34bd5ad84cd144b251319f185f81dbc7
- SHA256
  
  9b893feff48da793e5a74b018ebc00ad7fd4391a546295fce95e1a090f1f18fe
- SHA512
  
  7b1175ccbe91bd1129bbef055c5f89cf12f06e5dc50f1e74fc6cff617ade3dfa703f553b1c6a7b1394cb9b07cfa947a31aee6bdb981d3f7bbcf10c0953fdc8fe
- SSDEEP
  
  1536:Qdx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:m1+a614qVbh/b9QWpocYpxEtPf7megt
Score

3^/10

discovery
behavioral3 behavioral4