nanocore

General

Target

JaffaCakes118_b82b1a0b1a7517f85c5defbb7ce1c1c3ebbf926ef3a8eecd363409dfc702d4b1
Size

202KB
Sample

241230-1dnj7asmgt
MD5

e6e8b837d974cb986d4f8f31a8e47127
SHA1

a5f03f871250f433fce8c24d0a9c1c66678ccfa5
SHA256

b82b1a0b1a7517f85c5defbb7ce1c1c3ebbf926ef3a8eecd363409dfc702d4b1
SHA512

bdc080c0aadf6c001c6f9e9b0e5e6792af9a6fb96c9f15beaabfc13e9b6786e3ad76739077fe977efb1b3e1e5280a58a1440c21448161a792cc00d1ed1bbfd40
SSDEEP

6144:gLV6Bta6dtJmakIM5VrFjYgySEeVYTi9x7q:gLV6BtpmkOx4S93C

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

americanmedicalassociation.online:28146

213.152.161.211:28146

Mutex

3e6ee919-af63-442d-840b-68fb26064e33

Attributes

activate_away_mode
true
backup_connection_host
213.152.161.211
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-01-23T17:23:04.902126236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
28146
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
3e6ee919-af63-442d-840b-68fb26064e33
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
americanmedicalassociation.online
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  JaffaCakes118_b82b1a0b1a7517f85c5defbb7ce1c1c3ebbf926ef3a8eecd363409dfc702d4b1
- Size
  
  202KB
- MD5
  
  e6e8b837d974cb986d4f8f31a8e47127
- SHA1
  
  a5f03f871250f433fce8c24d0a9c1c66678ccfa5
- SHA256
  
  b82b1a0b1a7517f85c5defbb7ce1c1c3ebbf926ef3a8eecd363409dfc702d4b1
- SHA512
  
  bdc080c0aadf6c001c6f9e9b0e5e6792af9a6fb96c9f15beaabfc13e9b6786e3ad76739077fe977efb1b3e1e5280a58a1440c21448161a792cc00d1ed1bbfd40
- SSDEEP
  
  6144:gLV6Bta6dtJmakIM5VrFjYgySEeVYTi9x7q:gLV6BtpmkOx4S93C
Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Nanocore family
  nanocore
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Nanocore family

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2