General
- Target f8bet.exe
- Size 202KB
- Sample260705-d3cgwsg121
- SHA256 17f80f2f3a8b3afe40bc14906e58e0299099c1045667eaf865f4cd99ae06d271
- MD5 bbc14a1c2850a01b097521fb0de88de8
- SHA1 f58e11a1a9f8dfa0546b94bebe2b118013edea53
- SHA512 a43099bb4d88c30f260ef0ecd08aa48f8e92bb1f491b3e948270c212a3ef89ff58dc3f9c5e5f5918ee6cfae1d31a82e69c376fc9e48f34f5ed8e376f4416aeff
- SSDEEP 3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIk6fdBFvBeiDYI343auG3UBUss:gLV6Bta6dtJmakIM5ydBFvgiDUEszp9s
- TLSH T1B114CF2A7BB84A2FE2DE8679712201578379C2E398C3F3DE18C465B29F567E506071D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
f8bet.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
f8bet.exe
Resource
win11ltsc2024-20260630-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
f8betusd.com:443
-
f8bet288.net:443
Mutex
-
c3cc3a27-6b67-42cc-a157-fba8d5afec0a
Attributes
-
activate_away_mode
false
-
backup_connection_host
f8bet288.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2026-04-16T05:12:29.768220936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
443
-
default_group
F8BET
-
enable_debug_mode
false
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c3cc3a27-6b67-42cc-a157-fba8d5afec0a
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
f8betusd.com
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
- Target f8bet.exe
- Size 202KB
- SHA256 17f80f2f3a8b3afe40bc14906e58e0299099c1045667eaf865f4cd99ae06d271
- MD5 bbc14a1c2850a01b097521fb0de88de8
- SHA1 f58e11a1a9f8dfa0546b94bebe2b118013edea53
- SHA512 a43099bb4d88c30f260ef0ecd08aa48f8e92bb1f491b3e948270c212a3ef89ff58dc3f9c5e5f5918ee6cfae1d31a82e69c376fc9e48f34f5ed8e376f4416aeff
- SSDEEP 3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIk6fdBFvBeiDYI343auG3UBUss:gLV6Bta6dtJmakIM5ydBFvgiDUEszp9s
- TLSH T1B114CF2A7BB84A2FE2DE8679712201578379C2E398C3F3DE18C465B29F567E506071D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled