General
- Target coinx.exe
- Size 202KB
- Sample260628-xqksaacy2p
- SHA256 af154a4bb20730e0d8f7e88179b1797d8e67b23302ee2a0fa152dbd23a39a9dd
- MD5 5fea3f930de097794a95ced9dbae500c
- SHA1 b6c0e1b9da3c8f21bffbe878f58f3513848f3748
- SHA512 5ad4fb8aede9b82e26623802c271442b517282b02fa0d4fb4e896ce4f2d709152f028e5949d81b2248dab08a4817a5f24fa855236a3be28911d43c2f490831d8
- SSDEEP 6144:wLV6Bta6dtJmakIM5UF4ZMNCx5YKdiysf/u:wLV6BtpmkRUMQD/iy2/u
- TLSH T1D614CF563BA84A2FE2DF8679701212578378C2E398C3F3DA28D455B79F167E10A071D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
coinx.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
coinx.exe
Resource
win11ltsc2024-20260618-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
luttydin.ddns.net:54984
-
127.0.0.1:54984
Mutex
-
2974511b-85f7-4b21-b22c-93c684040308
Attributes
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2026-04-09T19:33:14.816109936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
3997
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485781e+07
-
mutex
2974511b-85f7-4b21-b22c-93c684040308
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
luttydin.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
- Target coinx.exe
- Size 202KB
- SHA256 af154a4bb20730e0d8f7e88179b1797d8e67b23302ee2a0fa152dbd23a39a9dd
- MD5 5fea3f930de097794a95ced9dbae500c
- SHA1 b6c0e1b9da3c8f21bffbe878f58f3513848f3748
- SHA512 5ad4fb8aede9b82e26623802c271442b517282b02fa0d4fb4e896ce4f2d709152f028e5949d81b2248dab08a4817a5f24fa855236a3be28911d43c2f490831d8
- SSDEEP 6144:wLV6Bta6dtJmakIM5UF4ZMNCx5YKdiysf/u:wLV6BtpmkRUMQD/iy2/u
- TLSH T1D614CF563BA84A2FE2DF8679701212578378C2E398C3F3DA28D455B79F167E10A071D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled