nanocore | 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119 | Triage

Sharing

General

Target

29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119
Size

202KB
Sample

240706-ymlqva1gjm
MD5

13053a6ac5c0422b5d17040f60a8da75
SHA1

afa55ecbd6b8ccef76b9f3c10890f80645035bf1
SHA256

29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119
SHA512

69dbe917e3e135d8210338745824bea61885e114ea859e3489362763ec7597a29089b789b4fb44534475a3e356e36fb2a46ecdf9fb38d99a7a68d9f7c9ad9df0
SSDEEP

3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIABSAShCWi5bu/qaBAIfG8vabG:wLV6Bta6dtJmakIM5mFhCWKbuf+PL4T

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

donm.ddnsking.com:4026

192.168.43.226:4026

Mutex

7d7d6645-ad52-41cb-8491-4679f254d10b

Attributes

activate_away_mode
true
backup_connection_host
192.168.43.226
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-04-13T23:20:34.789516736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
4026
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
7d7d6645-ad52-41cb-8491-4679f254d10b
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
donm.ddnsking.com
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119
- Size
  
  202KB
- MD5
  
  13053a6ac5c0422b5d17040f60a8da75
- SHA1
  
  afa55ecbd6b8ccef76b9f3c10890f80645035bf1
- SHA256
  
  29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119
- SHA512
  
  69dbe917e3e135d8210338745824bea61885e114ea859e3489362763ec7597a29089b789b4fb44534475a3e356e36fb2a46ecdf9fb38d99a7a68d9f7c9ad9df0
- SSDEEP
  
  3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIABSAShCWi5bu/qaBAIfG8vabG:wLV6Bta6dtJmakIM5mFhCWKbuf+PL4T
Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

nanocoreevasionkeyloggerpersistencespywarestealertrojan

behavioral2

nanocoreevasionkeyloggerpersistencespywarestealertrojan