General
- Target dosell.exe
- Size 202KB
- Sample260722-sbv79abn2z
- SHA256 bd623e7c651475939fe6b4ebe77090e21f2a9bb6f5a1e3dca88982a60a2755e2
- MD5 bba2c2f9b12b5cf57d05e948104ee282
- SHA1 788ce12a3e7cd0fed1aad80425ef82984d4bd122
- SHA512 712327511c4c7109c21a16e1dbddd409b91d4c3e2c922dc1c025aab9fee2827e8f30a5fa2ea0c8e4573d26d68fff53dd43dd5b64968817863aa1561ab38b5e95
- SSDEEP 3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIhRfdBFvBeiDYI343auG3UBUs4:gLV6Bta6dtJmakIM5adBFvgiDUEszp94
- TLSH T13314CF2A7BB84A2FE2DE8679712201578379C2E398C3F3DE18C465B29F567E506071D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
dosell.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
dosell.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
dosell.io:443
-
www.dosell.io:443
Mutex
-
779c868f-af70-4040-8978-68e63ce20140
Attributes
-
activate_away_mode
false
-
backup_connection_host
www.dosell.io
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2026-05-03T16:38:23.404051736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
443
-
default_group
Do Sell
-
enable_debug_mode
false
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
779c868f-af70-4040-8978-68e63ce20140
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dosell.io
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
- Target dosell.exe
- Size 202KB
- SHA256 bd623e7c651475939fe6b4ebe77090e21f2a9bb6f5a1e3dca88982a60a2755e2
- MD5 bba2c2f9b12b5cf57d05e948104ee282
- SHA1 788ce12a3e7cd0fed1aad80425ef82984d4bd122
- SHA512 712327511c4c7109c21a16e1dbddd409b91d4c3e2c922dc1c025aab9fee2827e8f30a5fa2ea0c8e4573d26d68fff53dd43dd5b64968817863aa1561ab38b5e95
- SSDEEP 3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIhRfdBFvBeiDYI343auG3UBUs4:gLV6Bta6dtJmakIM5adBFvgiDUEszp94
- TLSH T13314CF2A7BB84A2FE2DE8679712201578379C2E398C3F3DE18C465B29F567E506071D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled