nanocore | 3a15569906fdf9db4a3b7f7ecf5567f78b9626116505a11e81e3e0eba654b3da | Triage™

Login
Reports

Overview

overview

Static

static

Svchost.exe

windows10-2004-x64

Svchost.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
Svchost.exe
Size 116KB
Sample261007-v932vssz7q
SHA256 3a15569906fdf9db4a3b7f7ecf5567f78b9626116505a11e81e3e0eba654b3da
MD5 fc33e42e5e25ee0165e787e0e67ebc16
SHA1 e0863ea4cdb03580c3c11838e9f0ba5792514548
SHA512 7ba04a3183036b147b1e149cd2e097f47de64b2ffc637e2a8479038b866d324cf9a945d587aa11f20cf2ed1f4ce520b5da7284eb3d0987daa355af69a67d9637
SSDEEP 3072:XzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIZX:XLV6Bta6dtJmakIM5M
TLSH
T137C37C1677A84A2FE2DE8679712212139379C2E398C3F3DE28D455B78F267E50A071D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

nanocore defense_evasion discovery keylogger spyware stealer trojan

Static task

static1

2 signatures

keylogger trojan stealer spyware nanocore

Behavioral task

behavioral1

Sample

Svchost.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

30 seconds

defense_evasion discovery nanocore keylogger spyware stealer trojan

Behavioral task

behavioral2

Sample

Svchost.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

30 seconds

defense_evasion discovery nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Attributes

Targets

- Target
  Svchost.exe
- Size 116KB
- SHA256 3a15569906fdf9db4a3b7f7ecf5567f78b9626116505a11e81e3e0eba654b3da
- MD5 fc33e42e5e25ee0165e787e0e67ebc16
- SHA1 e0863ea4cdb03580c3c11838e9f0ba5792514548
- SHA512 7ba04a3183036b147b1e149cd2e097f47de64b2ffc637e2a8479038b866d324cf9a945d587aa11f20cf2ed1f4ce520b5da7284eb3d0987daa355af69a67d9637
- SSDEEP 3072:XzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIZX:XLV6Bta6dtJmakIM5M
- TLSH
  T137C37C1677A84A2FE2DE8679712212139379C2E398C3F3DE28D455B78F267E50A071D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nanocore keylogger spyware stealer trojan
- Family: NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

Match Legitimate Name or Location

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

keyloggertrojanstealerspywarenanocore

behavioral1

defense_evasiondiscoverynanocorekeyloggerspywarestealertrojan

behavioral2

defense_evasiondiscoverynanocorekeyloggerspywarestealertrojan

© 2018-2026

Terms | Privacy