nanocore | a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf | Triage

Sharing

General

Target

JaffaCakes118_1f104b823c9ac140f99dee39536db4e0
Size

740KB
Sample

241231-qws8aavndj
MD5

1f104b823c9ac140f99dee39536db4e0
SHA1

1551da1ade3252b446d7a7d80295697138859c50
SHA256

a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf
SHA512

f124db7fce940fd31ab99d4dfb9adafa1d24da985c976136e96637267146cb310d39b79382e447fff07f142b40dbb2c5c731d180e739ea8e6b0e507e618a8e30
SSDEEP

12288:P2ghLvPhXpe3Plf/X+tGrn33gUdCjIXjT6rrqX8lb7LMsHPEibTxzGmlFQJBk:BXhZgPlfrrAU4jprrjH3HJFz9+e

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_1f104b823c9ac140f99dee39536db4e0
- Size
  
  740KB
- MD5
  
  1f104b823c9ac140f99dee39536db4e0
- SHA1
  
  1551da1ade3252b446d7a7d80295697138859c50
- SHA256
  
  a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf
- SHA512
  
  f124db7fce940fd31ab99d4dfb9adafa1d24da985c976136e96637267146cb310d39b79382e447fff07f142b40dbb2c5c731d180e739ea8e6b0e507e618a8e30
- SSDEEP
  
  12288:P2ghLvPhXpe3Plf/X+tGrn33gUdCjIXjT6rrqX8lb7LMsHPEibTxzGmlFQJBk:BXhZgPlfrrAU4jprrjH3HJFz9+e
Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Nanocore family
  nanocore
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan