Overview

overview

10

Static

static

3

caf2e6460e...8N.exe

windows7-x64

10

caf2e6460e...8N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    caf2e6460e16dcf075f3ea8e0680b6a365fb3c211ac405d84de4a7ef71737648N.exe

  • Size

    891KB

  • Sample

    241231-3xahsaylfk

  • MD5

    742f9acb0afd3f441ddb2a7c05b83930

  • SHA1

    3bd1d38c8f97af03e74e741d01b8712816c56ed6

  • SHA256

    caf2e6460e16dcf075f3ea8e0680b6a365fb3c211ac405d84de4a7ef71737648

  • SHA512

    7c8214243b96e21f26125a5d818b7c9f096b2cfa615faff03b2c8049b623d18f42be07cb766b330bd382bf5465761c444f69a528724693b7365c9ee11744d433

  • SSDEEP

    12288:D3vWN7/wtNb5lO/SZ+BLOwI0YBI6SEC3uTJHdK+5LJ2AVZn3LCC4BUi/CiRKBdRU:jvWbWNlISkEP1LqAH9k+50X

Score
10/10
nanocorediscoveryevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

jamesilovecorn.myftp.biz:80

Mutex

db458c24-3972-48e0-85a6-e30efaedfd31

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2015-10-10T21:18:36.993322336Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    80

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    db458c24-3972-48e0-85a6-e30efaedfd31

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    jamesilovecorn.myftp.biz

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target

      caf2e6460e16dcf075f3ea8e0680b6a365fb3c211ac405d84de4a7ef71737648N.exe

    • Size

      891KB

    • MD5

      742f9acb0afd3f441ddb2a7c05b83930

    • SHA1

      3bd1d38c8f97af03e74e741d01b8712816c56ed6

    • SHA256

      caf2e6460e16dcf075f3ea8e0680b6a365fb3c211ac405d84de4a7ef71737648

    • SHA512

      7c8214243b96e21f26125a5d818b7c9f096b2cfa615faff03b2c8049b623d18f42be07cb766b330bd382bf5465761c444f69a528724693b7365c9ee11744d433

    • SSDEEP

      12288:D3vWN7/wtNb5lO/SZ+BLOwI0YBI6SEC3uTJHdK+5LJ2AVZn3LCC4BUi/CiRKBdRU:jvWbWNlISkEP1LqAH9k+50X

    Score
    10/10
    nanocorediscoveryevasionkeyloggerspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks