nanocore | 3f23e647fff8d2b4e202c3969d522e8f39566e617f856023ba845e706beb678d | Triage

Submit
Reports

Overview

overview

Static

static

3

b23a5d0a40...18.exe

windows7-x64

b23a5d0a40...18.exe

windows10-2004-x64

Sharing

General

Target

b23a5d0a402282f3608deb0604b0ac59_JaffaCakes118
Size

486KB
Sample

241129-s4m3catkd1
MD5

b23a5d0a402282f3608deb0604b0ac59
SHA1

9dbc48c80dbe974ff149e52b8b0cbeca1237685e
SHA256

3f23e647fff8d2b4e202c3969d522e8f39566e617f856023ba845e706beb678d
SHA512

ea81cf67fa3742aa8c8bf2c8359b10c75f3b8e5d707d748b78cd965ddb11c41d0a0fc9128b081729b88515125d7e8bce2067936066c57f158e3849af30d8de8e
SSDEEP

12288:YBEwjwVWydPicpWVw3najE86wf8pnzPnUYOHmD7UQUFaCb:I6tPicppnabjWzPUYSm7Up0e

Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b23a5d0a402282f3608deb0604b0ac59_JaffaCakes118.exe

Resource

win7-20240708-en

nanocore discovery evasion keylogger spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

b23a5d0a402282f3608deb0604b0ac59_JaffaCakes118.exe

Resource

win10v2004-20241007-en

nanocore discovery evasion keylogger spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  b23a5d0a402282f3608deb0604b0ac59_JaffaCakes118
- Size
  
  486KB
- MD5
  
  b23a5d0a402282f3608deb0604b0ac59
- SHA1
  
  9dbc48c80dbe974ff149e52b8b0cbeca1237685e
- SHA256
  
  3f23e647fff8d2b4e202c3969d522e8f39566e617f856023ba845e706beb678d
- SHA512
  
  ea81cf67fa3742aa8c8bf2c8359b10c75f3b8e5d707d748b78cd965ddb11c41d0a0fc9128b081729b88515125d7e8bce2067936066c57f158e3849af30d8de8e
- SSDEEP
  
  12288:YBEwjwVWydPicpWVw3najE86wf8pnzPnUYOHmD7UQUFaCb:I6tPicppnabjWzPUYSm7Up0e
Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Nanocore family
  nanocore
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

nanocorediscoveryevasionkeyloggerspywarestealertrojan

behavioral2

nanocorediscoveryevasionkeyloggerspywarestealertrojan

© 2018-2025

Terms | Privacy