Play interactive tour

Edit tour

Analysis Report swift copy.exe

Overview

General Information

Sample Name:	swift copy.exe
Analysis ID:	399719
MD5:	513beb90d191b7d4fadedd6c7119bfce
SHA1:	bfa4a87bc4c5f7ee6e3d38c1e1f733c665b8941e
SHA256:	c4bb3e5a6f33dca9143ede298d37b20c1dd8ab6be22f2544987f53d468e0e815
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected Nanocore RAT

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

swift copy.exe (PID: 4424 cmdline: 'C:\Users\user\Desktop\swift copy.exe' MD5: 513BEB90D191B7D4FADEDD6C7119BFCE)

schtasks.exe (PID: 68 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ucCIRTrm' /XML 'C:\Users\user\AppData\Local\Temp\tmp4B10.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

swift copy.exe (PID: 5472 cmdline: {path} MD5: 513BEB90D191B7D4FADEDD6C7119BFCE)

schtasks.exe (PID: 3440 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE011.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 2416 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpE300.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

swift copy.exe (PID: 3840 cmdline: 'C:\Users\user\Desktop\swift copy.exe' 0 MD5: 513BEB90D191B7D4FADEDD6C7119BFCE)

dhcpmon.exe (PID: 3088 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: 513BEB90D191B7D4FADEDD6C7119BFCE)

schtasks.exe (PID: 6772 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ucCIRTrm' /XML 'C:\Users\user\AppData\Local\Temp\tmpBC97.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 6844 cmdline: {path} MD5: 513BEB90D191B7D4FADEDD6C7119BFCE)

dhcpmon.exe (PID: 6864 cmdline: {path} MD5: 513BEB90D191B7D4FADEDD6C7119BFCE)

dhcpmon.exe (PID: 5032 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: 513BEB90D191B7D4FADEDD6C7119BFCE)

schtasks.exe (PID: 7088 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\ucCIRTrm' /XML 'C:\Users\user\AppData\Local\Temp\tmpE934.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 7144 cmdline: {path} MD5: 513BEB90D191B7D4FADEDD6C7119BFCE)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "eec4bb3f-f027-41de-b5f1-dc05041f", "Group": "Default", "Domain1": "celebrity.hopto.org", "Domain2": "127.0.0.1", "Port": 54888, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Enable", "SetCriticalProcess": "Enable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000001D.00000002.335972089.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000001D.00000002.335972089.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000002.335972089.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000004.00000002.482587211.0000000005CA0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x16e3:$x1: NanoCore.ClientPluginHost 0x171c:$x2: IClientNetworkHost
00000004.00000002.482587211.0000000005CA0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x16e3:$x2: NanoCore.ClientPluginHost 0x1800:$s4: PipeCreated 0x16fd:$s5: IClientLoggingHost
00000004.00000002.482338202.0000000005B40000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000004.00000002.482338202.0000000005B40000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000004.00000002.483111554.0000000006CD0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2205:$x1: NanoCore.ClientPluginHost 0x223e:$x2: IClientNetworkHost
00000004.00000002.483111554.0000000006CD0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2205:$x2: NanoCore.ClientPluginHost 0x2320:$s4: PipeCreated 0x221f:$s5: IClientLoggingHost
00000004.00000002.477582577.0000000003261000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.477582577.0000000003261000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2c7b7:$a: NanoCore 0x2c810:$a: NanoCore 0x2c84d:$a: NanoCore 0x2c8c6:$a: NanoCore 0x35462:$a: NanoCore 0x35487:$a: NanoCore 0x354e0:$a: NanoCore 0x45693:$a: NanoCore 0x456b9:$a: NanoCore 0x45715:$a: NanoCore 0x5257b:$a: NanoCore 0x525d4:$a: NanoCore 0x52607:$a: NanoCore 0x52833:$a: NanoCore 0x528af:$a: NanoCore 0x52ec8:$a: NanoCore 0x53011:$a: NanoCore 0x534e5:$a: NanoCore 0x537cc:$a: NanoCore 0x537e3:$a: NanoCore 0x5c693:$a: NanoCore
00000004.00000002.480362921.000000000439E000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.480362921.000000000439E000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4615:$a: NanoCore 0x466e:$a: NanoCore 0x46ab:$a: NanoCore 0x4724:$a: NanoCore 0xd1f8:$a: NanoCore 0xd21d:$a: NanoCore 0xd276:$a: NanoCore 0x1d413:$a: NanoCore 0x1d439:$a: NanoCore 0x1d495:$a: NanoCore 0x2a2ea:$a: NanoCore 0x2a343:$a: NanoCore 0x2a376:$a: NanoCore 0x2a5a2:$a: NanoCore 0x2a61e:$a: NanoCore 0x2ac37:$a: NanoCore 0x2ad80:$a: NanoCore 0x2b254:$a: NanoCore 0x2b53b:$a: NanoCore 0x2b552:$a: NanoCore 0x343f4:$a: NanoCore
00000001.00000002.246247391.0000000004111000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x33e57d:$x1: NanoCore.ClientPluginHost 0x33e5ba:$x2: IClientNetworkHost 0x3420ed:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.246247391.0000000004111000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.246247391.0000000004111000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x33e2e5:$a: NanoCore 0x33e2f5:$a: NanoCore 0x33e529:$a: NanoCore 0x33e53d:$a: NanoCore 0x33e57d:$a: NanoCore 0x33e344:$b: ClientPlugin 0x33e546:$b: ClientPlugin 0x33e586:$b: ClientPlugin 0x2a7bef:$c: ProjectData 0x33e46b:$c: ProjectData 0x33ee72:$d: DESCrypto 0x34683e:$e: KeepAlive 0x34482c:$g: LogClientMessage 0x340a27:$i: get_Connected 0x33f1a8:$j: #=q 0x33f1d8:$j: #=q 0x33f1f4:$j: #=q 0x33f224:$j: #=q 0x33f240:$j: #=q 0x33f25c:$j: #=q 0x33f28c:$j: #=q
0000001D.00000002.340068924.00000000028D1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000002.340068924.00000000028D1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3e043:$a: NanoCore 0x3e09c:$a: NanoCore 0x3e0d9:$a: NanoCore 0x3e152:$a: NanoCore 0x46e36:$a: NanoCore 0x46e5b:$a: NanoCore 0x46eb4:$a: NanoCore 0x570eb:$a: NanoCore 0x57111:$a: NanoCore 0x5716d:$a: NanoCore 0x6400b:$a: NanoCore 0x64064:$a: NanoCore 0x64097:$a: NanoCore 0x642c3:$a: NanoCore 0x6433f:$a: NanoCore 0x64958:$a: NanoCore 0x64aa1:$a: NanoCore 0x64f75:$a: NanoCore 0x6525c:$a: NanoCore 0x65273:$a: NanoCore 0x6e1e7:$a: NanoCore
00000004.00000002.483198841.0000000006D00000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x39eb:$x1: NanoCore.ClientPluginHost 0x3a24:$x2: IClientNetworkHost
00000004.00000002.483198841.0000000006D00000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x39eb:$x2: NanoCore.ClientPluginHost 0x3b36:$s4: PipeCreated 0x3a05:$s5: IClientLoggingHost
00000004.00000002.470491145.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000004.00000002.470491145.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000004.00000002.470491145.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000C.00000002.320469568.0000000003E11000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3f3b8d:$x1: NanoCore.ClientPluginHost 0x3f3bca:$x2: IClientNetworkHost 0x3f76fd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.320469568.0000000003E11000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.320469568.0000000003E11000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3f38f5:$a: NanoCore 0x3f3905:$a: NanoCore 0x3f3b39:$a: NanoCore 0x3f3b4d:$a: NanoCore 0x3f3b8d:$a: NanoCore 0x3f3954:$b: ClientPlugin 0x3f3b56:$b: ClientPlugin 0x3f3b96:$b: ClientPlugin 0x3f3a7b:$c: ProjectData 0x7b02e7:$c: ProjectData 0x3f4482:$d: DESCrypto 0x3fbe4e:$e: KeepAlive 0x3f9e3c:$g: LogClientMessage 0x3f6037:$i: get_Connected 0x3f47b8:$j: #=q 0x3f47e8:$j: #=q 0x3f4804:$j: #=q 0x3f4834:$j: #=q 0x3f4850:$j: #=q 0x3f486c:$j: #=q 0x3f489c:$j: #=q
0000000C.00000002.324426254.0000000004619000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x11a33d:$x1: NanoCore.ClientPluginHost 0x11a37a:$x2: IClientNetworkHost 0x11dead:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.324426254.0000000004619000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.324426254.0000000004619000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x11a0a5:$a: NanoCore 0x11a0b5:$a: NanoCore 0x11a2e9:$a: NanoCore 0x11a2fd:$a: NanoCore 0x11a33d:$a: NanoCore 0x11a104:$b: ClientPlugin 0x11a306:$b: ClientPlugin 0x11a346:$b: ClientPlugin 0x11a22b:$c: ProjectData 0x11ac32:$d: DESCrypto 0x1225fe:$e: KeepAlive 0x1205ec:$g: LogClientMessage 0x11c7e7:$i: get_Connected 0x11af68:$j: #=q 0x11af98:$j: #=q 0x11afb4:$j: #=q 0x11afe4:$j: #=q 0x11b000:$j: #=q 0x11b01c:$j: #=q 0x11b04c:$j: #=q 0x11b068:$j: #=q
00000004.00000002.482362753.0000000005B50000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost
00000004.00000002.482362753.0000000005B50000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4bbb:$x2: NanoCore.ClientPluginHost 0x6a6b:$s4: PipeCreated
00000020.00000002.351801579.0000000002901000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000020.00000002.351801579.0000000002901000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3a4c3:$a: NanoCore 0x3a51c:$a: NanoCore 0x3a559:$a: NanoCore 0x3a5d2:$a: NanoCore 0x432b6:$a: NanoCore 0x432db:$a: NanoCore 0x43334:$a: NanoCore 0x5356b:$a: NanoCore 0x53591:$a: NanoCore 0x535ed:$a: NanoCore 0x6048b:$a: NanoCore 0x604e4:$a: NanoCore 0x60517:$a: NanoCore 0x60743:$a: NanoCore 0x607bf:$a: NanoCore 0x60dd8:$a: NanoCore 0x60f21:$a: NanoCore 0x613f5:$a: NanoCore 0x616dc:$a: NanoCore 0x616f3:$a: NanoCore 0x6a667:$a: NanoCore
00000004.00000002.483085818.0000000006CC0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5b0b:$x1: NanoCore.ClientPluginHost 0x5b44:$x2: IClientNetworkHost
00000004.00000002.483085818.0000000006CC0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5b0b:$x2: NanoCore.ClientPluginHost 0x5c0f:$s4: PipeCreated 0x5b25:$s5: IClientLoggingHost
00000004.00000002.482502454.0000000005C30000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost
00000004.00000002.482502454.0000000005C30000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x8ba5:$x2: NanoCore.ClientPluginHost 0x9b74:$s2: FileCommand 0xe576:$s4: PipeCreated 0x8bbf:$s5: IClientLoggingHost
00000001.00000002.249898670.0000000004919000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x16669d:$x1: NanoCore.ClientPluginHost 0x1666da:$x2: IClientNetworkHost 0x16a20d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.249898670.0000000004919000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.249898670.0000000004919000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x166405:$a: NanoCore 0x166415:$a: NanoCore 0x166649:$a: NanoCore 0x16665d:$a: NanoCore 0x16669d:$a: NanoCore 0x166464:$b: ClientPlugin 0x166666:$b: ClientPlugin 0x1666a6:$b: ClientPlugin 0x16658b:$c: ProjectData 0x166f92:$d: DESCrypto 0x16e95e:$e: KeepAlive 0x16c94c:$g: LogClientMessage 0x168b47:$i: get_Connected 0x1672c8:$j: #=q 0x1672f8:$j: #=q 0x167314:$j: #=q 0x167344:$j: #=q 0x167360:$j: #=q 0x16737c:$j: #=q 0x1673ac:$j: #=q 0x1673c8:$j: #=q
0000000E.00000002.341991938.0000000004C19000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x11a33d:$x1: NanoCore.ClientPluginHost 0x11a37a:$x2: IClientNetworkHost 0x11dead:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000002.341991938.0000000004C19000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.341991938.0000000004C19000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x11a0a5:$a: NanoCore 0x11a0b5:$a: NanoCore 0x11a2e9:$a: NanoCore 0x11a2fd:$a: NanoCore 0x11a33d:$a: NanoCore 0x11a104:$b: ClientPlugin 0x11a306:$b: ClientPlugin 0x11a346:$b: ClientPlugin 0x11a22b:$c: ProjectData 0x11ac32:$d: DESCrypto 0x1225fe:$e: KeepAlive 0x1205ec:$g: LogClientMessage 0x11c7e7:$i: get_Connected 0x11af68:$j: #=q 0x11af98:$j: #=q 0x11afb4:$j: #=q 0x11afe4:$j: #=q 0x11b000:$j: #=q 0x11b01c:$j: #=q 0x11b04c:$j: #=q 0x11b068:$j: #=q
00000020.00000002.348556738.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000020.00000002.348556738.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000020.00000002.348556738.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000001D.00000002.340592652.00000000038D9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000001D.00000002.340592652.00000000038D9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x139615:$a: NanoCore 0x13966e:$a: NanoCore 0x1396ab:$a: NanoCore 0x139724:$a: NanoCore 0x1421f8:$a: NanoCore 0x14221d:$a: NanoCore 0x142276:$a: NanoCore 0x152413:$a: NanoCore 0x152439:$a: NanoCore 0x152495:$a: NanoCore 0x15f2ea:$a: NanoCore 0x15f343:$a: NanoCore 0x15f376:$a: NanoCore 0x15f5a2:$a: NanoCore 0x15f61e:$a: NanoCore 0x15fc37:$a: NanoCore 0x15fd80:$a: NanoCore 0x160254:$a: NanoCore 0x16053b:$a: NanoCore 0x160552:$a: NanoCore 0x1693f4:$a: NanoCore
0000000E.00000002.338588185.0000000004411000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3f3b8d:$x1: NanoCore.ClientPluginHost 0x3f3bca:$x2: IClientNetworkHost 0x3f76fd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000E.00000002.338588185.0000000004411000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000E.00000002.338588185.0000000004411000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3f38f5:$a: NanoCore 0x3f3905:$a: NanoCore 0x3f3b39:$a: NanoCore 0x3f3b4d:$a: NanoCore 0x3f3b8d:$a: NanoCore 0x3f3954:$b: ClientPlugin 0x3f3b56:$b: ClientPlugin 0x3f3b96:$b: ClientPlugin 0x3f3a7b:$c: ProjectData 0x3f4482:$d: DESCrypto 0x3fbe4e:$e: KeepAlive 0x3f9e3c:$g: LogClientMessage 0x3f6037:$i: get_Connected 0x3f47b8:$j: #=q 0x3f47e8:$j: #=q 0x3f4804:$j: #=q 0x3f4834:$j: #=q 0x3f4850:$j: #=q 0x3f486c:$j: #=q 0x3f489c:$j: #=q 0x3f48b8:$j: #=q
00000004.00000002.483135029.0000000006CE0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13a8:$x1: NanoCore.ClientPluginHost
00000004.00000002.483135029.0000000006CE0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x13a8:$x2: NanoCore.ClientPluginHost 0x1486:$s4: PipeCreated 0x13c2:$s5: IClientLoggingHost
00000020.00000002.354540335.0000000003909000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000020.00000002.354540335.0000000003909000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x139615:$a: NanoCore 0x13966e:$a: NanoCore 0x1396ab:$a: NanoCore 0x139724:$a: NanoCore 0x1421f8:$a: NanoCore 0x14221d:$a: NanoCore 0x142276:$a: NanoCore 0x152413:$a: NanoCore 0x152439:$a: NanoCore 0x152495:$a: NanoCore 0x15f2ea:$a: NanoCore 0x15f343:$a: NanoCore 0x15f376:$a: NanoCore 0x15f5a2:$a: NanoCore 0x15f61e:$a: NanoCore 0x15fc37:$a: NanoCore 0x15fd80:$a: NanoCore 0x160254:$a: NanoCore 0x16053b:$a: NanoCore 0x160552:$a: NanoCore 0x1693f4:$a: NanoCore
Process Memory Space: dhcpmon.exe PID: 3088	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: swift copy.exe PID: 3840	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 7144	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x49de7:$x1: NanoCore.ClientPluginHost 0x4cc06:$x1: NanoCore.ClientPluginHost 0x57520:$x1: NanoCore.ClientPluginHost 0x6a09c:$x1: NanoCore.ClientPluginHost 0x6d0ec:$x1: NanoCore.ClientPluginHost 0x724a0:$x1: NanoCore.ClientPluginHost 0x758f6:$x1: NanoCore.ClientPluginHost 0x78103:$x1: NanoCore.ClientPluginHost 0x7cf5e:$x1: NanoCore.ClientPluginHost 0x89738:$x1: NanoCore.ClientPluginHost 0x90880:$x1: NanoCore.ClientPluginHost 0xb4a0d:$x1: NanoCore.ClientPluginHost 0xb77da:$x1: NanoCore.ClientPluginHost 0xc20f4:$x1: NanoCore.ClientPluginHost 0xd4c6f:$x1: NanoCore.ClientPluginHost 0xd7cbe:$x1: NanoCore.ClientPluginHost 0xdd072:$x1: NanoCore.ClientPluginHost 0xe04c7:$x1: NanoCore.ClientPluginHost 0xe2cbf:$x1: NanoCore.ClientPluginHost 0xe7b1a:$x1: NanoCore.ClientPluginHost 0xf42f4:$x1: NanoCore.ClientPluginHost
Process Memory Space: dhcpmon.exe PID: 7144	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 7144	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2b328:$a: NanoCore 0x32c1e:$a: NanoCore 0x32c85:$a: NanoCore 0x32d28:$a: NanoCore 0x49cd9:$a: NanoCore 0x49d7a:$a: NanoCore 0x49de7:$a: NanoCore 0x49ea8:$a: NanoCore 0x4ad79:$a: NanoCore 0x4adcc:$a: NanoCore 0x4ae05:$a: NanoCore 0x4ae78:$a: NanoCore 0x4cbc9:$a: NanoCore 0x4cc06:$a: NanoCore 0x4cc8f:$a: NanoCore 0x52027:$a: NanoCore 0x5204a:$a: NanoCore 0x5209f:$a: NanoCore 0x574e2:$a: NanoCore 0x57520:$a: NanoCore 0x575ac:$a: NanoCore
Process Memory Space: swift copy.exe PID: 4424	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5115c5:$x1: NanoCore.ClientPluginHost 0x511626:$x2: IClientNetworkHost 0x516a2b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x52499d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: swift copy.exe PID: 4424	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: swift copy.exe PID: 4424	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: swift copy.exe PID: 4424	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x5110ca:$a: NanoCore 0x5110e6:$a: NanoCore 0x511241:$a: NanoCore 0x511250:$a: NanoCore 0x511529:$a: NanoCore 0x511555:$a: NanoCore 0x5115c5:$a: NanoCore 0x521007:$a: NanoCore 0x521019:$a: NanoCore 0x521055:$a: NanoCore 0x511171:$b: ClientPlugin 0x51129a:$b: ClientPlugin 0x51155e:$b: ClientPlugin 0x5115ce:$b: ClientPlugin 0x521022:$b: ClientPlugin 0x52105e:$b: ClientPlugin 0x501a62:$c: ProjectData 0x502999:$c: ProjectData 0x5113e7:$c: ProjectData 0x520f54:$c: ProjectData 0x1cd7826:$c: ProjectData
Process Memory Space: dhcpmon.exe PID: 5032	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: swift copy.exe PID: 5472	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd4dde:$x1: NanoCore.ClientPluginHost 0xd7bab:$x1: NanoCore.ClientPluginHost 0xe24c5:$x1: NanoCore.ClientPluginHost 0xf5041:$x1: NanoCore.ClientPluginHost 0xf8091:$x1: NanoCore.ClientPluginHost 0xfd445:$x1: NanoCore.ClientPluginHost 0x10089b:$x1: NanoCore.ClientPluginHost 0x103094:$x1: NanoCore.ClientPluginHost 0x107eef:$x1: NanoCore.ClientPluginHost 0x1146c9:$x1: NanoCore.ClientPluginHost 0x11b811:$x1: NanoCore.ClientPluginHost 0x14c955:$x1: NanoCore.ClientPluginHost 0x14f722:$x1: NanoCore.ClientPluginHost 0x15a03c:$x1: NanoCore.ClientPluginHost 0x16cbb7:$x1: NanoCore.ClientPluginHost 0x16fc06:$x1: NanoCore.ClientPluginHost 0x174fba:$x1: NanoCore.ClientPluginHost 0x17840f:$x1: NanoCore.ClientPluginHost 0x17ac07:$x1: NanoCore.ClientPluginHost 0x17fa62:$x1: NanoCore.ClientPluginHost 0x18c23c:$x1: NanoCore.ClientPluginHost
Process Memory Space: swift copy.exe PID: 5472	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: swift copy.exe PID: 5472	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x27219:$a: NanoCore 0x277d6:$a: NanoCore 0x2b7a7:$a: NanoCore 0x2b7c4:$a: NanoCore 0x2b875:$a: NanoCore 0x2bdca:$a: NanoCore 0x2bdef:$a: NanoCore 0x2be97:$a: NanoCore 0xc78b6:$a: NanoCore 0xc791d:$a: NanoCore 0xc79c0:$a: NanoCore 0xd4cd0:$a: NanoCore 0xd4d71:$a: NanoCore 0xd4dde:$a: NanoCore 0xd4e9f:$a: NanoCore 0xd5d70:$a: NanoCore 0xd5dc3:$a: NanoCore 0xd5dfc:$a: NanoCore 0xd5e6f:$a: NanoCore 0xd7b6e:$a: NanoCore 0xd7bab:$a: NanoCore
Click to see the 63 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
32.2.dhcpmon.exe.3a46662.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
32.2.dhcpmon.exe.3a46662.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
4.2.swift copy.exe.6cd0000.15.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2205:$x1: NanoCore.ClientPluginHost 0x223e:$x2: IClientNetworkHost
4.2.swift copy.exe.6cd0000.15.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2205:$x2: NanoCore.ClientPluginHost 0x2320:$s4: PipeCreated 0x221f:$s5: IClientLoggingHost
4.2.swift copy.exe.5c30000.11.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
4.2.swift copy.exe.5c30000.11.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
32.2.dhcpmon.exe.294b9ec.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
32.2.dhcpmon.exe.294b9ec.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
4.2.swift copy.exe.32918cc.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
4.2.swift copy.exe.32918cc.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
1.2.swift copy.exe.4a6f510.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.swift copy.exe.4a6f510.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.2.swift copy.exe.4a6f510.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.swift copy.exe.4a6f510.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
4.2.swift copy.exe.43b2894.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
4.2.swift copy.exe.43b2894.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
1.2.swift copy.exe.4a6f510.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.swift copy.exe.4a6f510.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.swift copy.exe.4a6f510.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
32.2.dhcpmon.exe.294b9ec.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x15d57:$x1: NanoCore.ClientPluginHost 0x1fc7b:$x1: NanoCore.ClientPluginHost 0x27be9:$x1: NanoCore.ClientPluginHost 0x2dc04:$x1: NanoCore.ClientPluginHost 0x356bb:$x1: NanoCore.ClientPluginHost 0x407f1:$x1: NanoCore.ClientPluginHost 0x4c5df:$x1: NanoCore.ClientPluginHost 0x5842e:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost 0x15d90:$x2: IClientNetworkHost 0x1fcb4:$x2: IClientNetworkHost 0x27c22:$x2: IClientNetworkHost 0x356f4:$x2: IClientNetworkHost 0x4080b:$x2: IClientNetworkHost 0x4c5f9:$x2: IClientNetworkHost 0x5846b:$x2: IClientNetworkHost
32.2.dhcpmon.exe.294b9ec.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x8ba5:$x2: NanoCore.ClientPluginHost 0x15d57:$x2: NanoCore.ClientPluginHost 0x1fc7b:$x2: NanoCore.ClientPluginHost 0x27be9:$x2: NanoCore.ClientPluginHost 0x2dc04:$x2: NanoCore.ClientPluginHost 0x356bb:$x2: NanoCore.ClientPluginHost 0x407f1:$x2: NanoCore.ClientPluginHost 0x4c5df:$x2: NanoCore.ClientPluginHost 0x5842e:$x2: NanoCore.ClientPluginHost 0x9b74:$s2: FileCommand 0xe576:$s4: PipeCreated 0x15e74:$s4: PipeCreated 0x1fd7f:$s4: PipeCreated 0x27d04:$s4: PipeCreated 0x2dce2:$s4: PipeCreated 0x35806:$s4: PipeCreated 0x41826:$s4: PipeCreated 0x4e38a:$s4: PipeCreated 0x5b881:$s4: PipeCreated 0x8bbf:$s5: IClientLoggingHost 0x15d71:$s5: IClientLoggingHost
32.2.dhcpmon.exe.294b9ec.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8b7f:$a: NanoCore 0x8ba5:$a: NanoCore 0x8c01:$a: NanoCore 0x15a9f:$a: NanoCore 0x15af8:$a: NanoCore 0x15b2b:$a: NanoCore 0x15d57:$a: NanoCore 0x15dd3:$a: NanoCore 0x163ec:$a: NanoCore 0x16535:$a: NanoCore 0x16a09:$a: NanoCore 0x16cf0:$a: NanoCore 0x16d07:$a: NanoCore 0x1fc7b:$a: NanoCore 0x1fcf7:$a: NanoCore 0x225da:$a: NanoCore 0x27be9:$a: NanoCore 0x27c63:$a: NanoCore 0x2dc04:$a: NanoCore 0x2dc4e:$a: NanoCore 0x2e8a8:$a: NanoCore
4.2.swift copy.exe.6d00000.17.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x39eb:$x1: NanoCore.ClientPluginHost 0x3a24:$x2: IClientNetworkHost
4.2.swift copy.exe.6d00000.17.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x39eb:$x2: NanoCore.ClientPluginHost 0x3b36:$s4: PipeCreated 0x3a05:$s5: IClientLoggingHost
32.2.dhcpmon.exe.3a52894.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
32.2.dhcpmon.exe.3a52894.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
4.2.swift copy.exe.5b40000.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
4.2.swift copy.exe.5b40000.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
4.2.swift copy.exe.6ce0000.16.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13a8:$x1: NanoCore.ClientPluginHost
4.2.swift copy.exe.6ce0000.16.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x13a8:$x2: NanoCore.ClientPluginHost 0x1486:$s4: PipeCreated 0x13c2:$s5: IClientLoggingHost
29.2.dhcpmon.exe.29132a0.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x14e71:$x1: NanoCore.ClientPluginHost 0x22023:$x1: NanoCore.ClientPluginHost 0x2bf47:$x1: NanoCore.ClientPluginHost 0x33eb5:$x1: NanoCore.ClientPluginHost 0x39ed0:$x1: NanoCore.ClientPluginHost 0x41987:$x1: NanoCore.ClientPluginHost 0x4cabd:$x1: NanoCore.ClientPluginHost 0x588ab:$x1: NanoCore.ClientPluginHost 0x646fa:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost 0x14e9e:$x2: IClientNetworkHost 0x2205c:$x2: IClientNetworkHost 0x2bf80:$x2: IClientNetworkHost 0x33eee:$x2: IClientNetworkHost 0x419c0:$x2: IClientNetworkHost 0x4cad7:$x2: IClientNetworkHost 0x588c5:$x2: IClientNetworkHost 0x64737:$x2: IClientNetworkHost
29.2.dhcpmon.exe.29132a0.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4bbb:$x2: NanoCore.ClientPluginHost 0x14e71:$x2: NanoCore.ClientPluginHost 0x22023:$x2: NanoCore.ClientPluginHost 0x2bf47:$x2: NanoCore.ClientPluginHost 0x33eb5:$x2: NanoCore.ClientPluginHost 0x39ed0:$x2: NanoCore.ClientPluginHost 0x41987:$x2: NanoCore.ClientPluginHost 0x4cabd:$x2: NanoCore.ClientPluginHost 0x588ab:$x2: NanoCore.ClientPluginHost 0x646fa:$x2: NanoCore.ClientPluginHost 0x15e40:$s2: FileCommand 0x6a6b:$s4: PipeCreated 0x1a842:$s4: PipeCreated 0x22140:$s4: PipeCreated 0x2c04b:$s4: PipeCreated 0x33fd0:$s4: PipeCreated 0x39fae:$s4: PipeCreated 0x41ad2:$s4: PipeCreated 0x4daf2:$s4: PipeCreated 0x5a656:$s4: PipeCreated 0x67b4d:$s4: PipeCreated
29.2.dhcpmon.exe.29132a0.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4b96:$a: NanoCore 0x4bbb:$a: NanoCore 0x4c14:$a: NanoCore 0x14e4b:$a: NanoCore 0x14e71:$a: NanoCore 0x14ecd:$a: NanoCore 0x21d6b:$a: NanoCore 0x21dc4:$a: NanoCore 0x21df7:$a: NanoCore 0x22023:$a: NanoCore 0x2209f:$a: NanoCore 0x226b8:$a: NanoCore 0x22801:$a: NanoCore 0x22cd5:$a: NanoCore 0x22fbc:$a: NanoCore 0x22fd3:$a: NanoCore 0x2bf47:$a: NanoCore 0x2bfc3:$a: NanoCore 0x2e8a6:$a: NanoCore 0x33eb5:$a: NanoCore 0x33f2f:$a: NanoCore
4.2.swift copy.exe.6cd0000.15.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x605:$x1: NanoCore.ClientPluginHost 0x63e:$x2: IClientNetworkHost
4.2.swift copy.exe.6cd0000.15.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x605:$x2: NanoCore.ClientPluginHost 0x720:$s4: PipeCreated 0x61f:$s5: IClientLoggingHost
14.2.dhcpmon.exe.4d231b0.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.dhcpmon.exe.4d231b0.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
14.2.dhcpmon.exe.4d231b0.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.4d231b0.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
4.2.swift copy.exe.6d00000.17.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1deb:$x1: NanoCore.ClientPluginHost 0x1e24:$x2: IClientNetworkHost
4.2.swift copy.exe.6d00000.17.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1deb:$x2: NanoCore.ClientPluginHost 0x1f36:$s4: PipeCreated 0x1e05:$s5: IClientLoggingHost
14.2.dhcpmon.exe.46af9b0.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1551dd:$x1: NanoCore.ClientPluginHost 0x15521a:$x2: IClientNetworkHost 0x158d4d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.dhcpmon.exe.46af9b0.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.46af9b0.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x154f45:$a: NanoCore 0x154f55:$a: NanoCore 0x155189:$a: NanoCore 0x15519d:$a: NanoCore 0x1551dd:$a: NanoCore 0x154fa4:$b: ClientPlugin 0x1551a6:$b: ClientPlugin 0x1551e6:$b: ClientPlugin 0x1550cb:$c: ProjectData 0x155ad2:$d: DESCrypto 0x15d49e:$e: KeepAlive 0x15b48c:$g: LogClientMessage 0x157687:$i: get_Connected 0x155e08:$j: #=q 0x155e38:$j: #=q 0x155e54:$j: #=q 0x155e84:$j: #=q 0x155ea0:$j: #=q 0x155ebc:$j: #=q 0x155eec:$j: #=q 0x155f08:$j: #=q
12.2.dhcpmon.exe.47231b0.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.dhcpmon.exe.47231b0.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.47231b0.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.47231b0.5.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
4.2.swift copy.exe.328c9d8.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x9aaf:$x1: NanoCore.ClientPluginHost 0x19ce1:$x1: NanoCore.ClientPluginHost 0x26e5b:$x1: NanoCore.ClientPluginHost 0x30cbb:$x1: NanoCore.ClientPluginHost 0x38bf1:$x1: NanoCore.ClientPluginHost 0x3ebd4:$x1: NanoCore.ClientPluginHost 0x46653:$x1: NanoCore.ClientPluginHost 0x51645:$x1: NanoCore.ClientPluginHost 0x5d3fb:$x1: NanoCore.ClientPluginHost 0x6918a:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x9ad9:$x2: IClientNetworkHost 0x19d0e:$x2: IClientNetworkHost 0x26e94:$x2: IClientNetworkHost 0x30cf4:$x2: IClientNetworkHost 0x38c2a:$x2: IClientNetworkHost 0x4668c:$x2: IClientNetworkHost 0x5165f:$x2: IClientNetworkHost 0x5d415:$x2: IClientNetworkHost 0x691c7:$x2: IClientNetworkHost
4.2.swift copy.exe.328c9d8.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x9a8a:$a: NanoCore 0x9aaf:$a: NanoCore 0x9b08:$a: NanoCore 0x19cbb:$a: NanoCore 0x19ce1:$a: NanoCore 0x19d3d:$a: NanoCore 0x26ba3:$a: NanoCore 0x26bfc:$a: NanoCore 0x26c2f:$a: NanoCore 0x26e5b:$a: NanoCore 0x26ed7:$a: NanoCore 0x274f0:$a: NanoCore 0x27639:$a: NanoCore 0x27b0d:$a: NanoCore 0x27df4:$a: NanoCore 0x27e0b:$a: NanoCore 0x30cbb:$a: NanoCore
4.2.swift copy.exe.5c30000.11.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost
4.2.swift copy.exe.5c30000.11.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x8ba5:$x2: NanoCore.ClientPluginHost 0x9b74:$s2: FileCommand 0xe576:$s4: PipeCreated 0x8bbf:$s5: IClientLoggingHost
14.2.dhcpmon.exe.4d231b0.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
14.2.dhcpmon.exe.4d231b0.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
14.2.dhcpmon.exe.4d231b0.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
14.2.dhcpmon.exe.4d231b0.4.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
4.2.swift copy.exe.5ca0000.12.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x16e3:$x1: NanoCore.ClientPluginHost 0x171c:$x2: IClientNetworkHost
4.2.swift copy.exe.5ca0000.12.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x16e3:$x2: NanoCore.ClientPluginHost 0x1800:$s4: PipeCreated 0x16fd:$s5: IClientLoggingHost
29.2.dhcpmon.exe.291f56c.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x15d57:$x1: NanoCore.ClientPluginHost 0x1fc7b:$x1: NanoCore.ClientPluginHost 0x27be9:$x1: NanoCore.ClientPluginHost 0x2dc04:$x1: NanoCore.ClientPluginHost 0x356bb:$x1: NanoCore.ClientPluginHost 0x407f1:$x1: NanoCore.ClientPluginHost 0x4c5df:$x1: NanoCore.ClientPluginHost 0x5842e:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost 0x15d90:$x2: IClientNetworkHost 0x1fcb4:$x2: IClientNetworkHost 0x27c22:$x2: IClientNetworkHost 0x356f4:$x2: IClientNetworkHost 0x4080b:$x2: IClientNetworkHost 0x4c5f9:$x2: IClientNetworkHost 0x5846b:$x2: IClientNetworkHost
29.2.dhcpmon.exe.291f56c.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x8ba5:$x2: NanoCore.ClientPluginHost 0x15d57:$x2: NanoCore.ClientPluginHost 0x1fc7b:$x2: NanoCore.ClientPluginHost 0x27be9:$x2: NanoCore.ClientPluginHost 0x2dc04:$x2: NanoCore.ClientPluginHost 0x356bb:$x2: NanoCore.ClientPluginHost 0x407f1:$x2: NanoCore.ClientPluginHost 0x4c5df:$x2: NanoCore.ClientPluginHost 0x5842e:$x2: NanoCore.ClientPluginHost 0x9b74:$s2: FileCommand 0xe576:$s4: PipeCreated 0x15e74:$s4: PipeCreated 0x1fd7f:$s4: PipeCreated 0x27d04:$s4: PipeCreated 0x2dce2:$s4: PipeCreated 0x35806:$s4: PipeCreated 0x41826:$s4: PipeCreated 0x4e38a:$s4: PipeCreated 0x5b881:$s4: PipeCreated 0x8bbf:$s5: IClientLoggingHost 0x15d71:$s5: IClientLoggingHost
29.2.dhcpmon.exe.291f56c.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8b7f:$a: NanoCore 0x8ba5:$a: NanoCore 0x8c01:$a: NanoCore 0x15a9f:$a: NanoCore 0x15af8:$a: NanoCore 0x15b2b:$a: NanoCore 0x15d57:$a: NanoCore 0x15dd3:$a: NanoCore 0x163ec:$a: NanoCore 0x16535:$a: NanoCore 0x16a09:$a: NanoCore 0x16cf0:$a: NanoCore 0x16d07:$a: NanoCore 0x1fc7b:$a: NanoCore 0x1fcf7:$a: NanoCore 0x225da:$a: NanoCore 0x27be9:$a: NanoCore 0x27c63:$a: NanoCore 0x2dc04:$a: NanoCore 0x2dc4e:$a: NanoCore 0x2e8a8:$a: NanoCore
4.2.swift copy.exe.329db14.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x15d1f:$x1: NanoCore.ClientPluginHost 0x1fb7f:$x1: NanoCore.ClientPluginHost 0x27ab5:$x1: NanoCore.ClientPluginHost 0x2da98:$x1: NanoCore.ClientPluginHost 0x35517:$x1: NanoCore.ClientPluginHost 0x40509:$x1: NanoCore.ClientPluginHost 0x4c2bf:$x1: NanoCore.ClientPluginHost 0x5804e:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost 0x15d58:$x2: IClientNetworkHost 0x1fbb8:$x2: IClientNetworkHost 0x27aee:$x2: IClientNetworkHost 0x35550:$x2: IClientNetworkHost 0x40523:$x2: IClientNetworkHost 0x4c2d9:$x2: IClientNetworkHost 0x5808b:$x2: IClientNetworkHost
4.2.swift copy.exe.329db14.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8b7f:$a: NanoCore 0x8ba5:$a: NanoCore 0x8c01:$a: NanoCore 0x15a67:$a: NanoCore 0x15ac0:$a: NanoCore 0x15af3:$a: NanoCore 0x15d1f:$a: NanoCore 0x15d9b:$a: NanoCore 0x163b4:$a: NanoCore 0x164fd:$a: NanoCore 0x169d1:$a: NanoCore 0x16cb8:$a: NanoCore 0x16ccf:$a: NanoCore 0x1fb7f:$a: NanoCore 0x1fbfb:$a: NanoCore 0x224de:$a: NanoCore 0x27ab5:$a: NanoCore 0x27b2f:$a: NanoCore 0x2da98:$a: NanoCore 0x2dae2:$a: NanoCore 0x2e73c:$a: NanoCore
32.2.dhcpmon.exe.3a52894.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x15d0e:$x1: NanoCore.ClientPluginHost 0x1fb60:$x1: NanoCore.ClientPluginHost 0x27a86:$x1: NanoCore.ClientPluginHost 0x2da57:$x1: NanoCore.ClientPluginHost 0x354c5:$x1: NanoCore.ClientPluginHost 0x404a2:$x1: NanoCore.ClientPluginHost 0x4c244:$x1: NanoCore.ClientPluginHost 0x6171c:$x1: NanoCore.ClientPluginHost 0x8997e:$x1: NanoCore.ClientPluginHost 0x98dbe:$x1: NanoCore.ClientPluginHost 0xb1161:$x1: NanoCore.ClientPluginHost 0xd93af:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost 0x15d47:$x2: IClientNetworkHost 0x1fb99:$x2: IClientNetworkHost 0x27abf:$x2: IClientNetworkHost 0x354fe:$x2: IClientNetworkHost 0x404bc:$x2: IClientNetworkHost 0x4c25e:$x2: IClientNetworkHost 0x61749:$x2: IClientNetworkHost
4.2.swift copy.exe.6cc0000.14.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3f0b:$x1: NanoCore.ClientPluginHost 0x3f44:$x2: IClientNetworkHost
4.2.swift copy.exe.6cc0000.14.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x3f0b:$x2: NanoCore.ClientPluginHost 0x400f:$s4: PipeCreated 0x3f25:$s5: IClientLoggingHost
29.2.dhcpmon.exe.3a22894.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
4.2.swift copy.exe.5b50000.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost
4.2.swift copy.exe.5b50000.10.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4bbb:$x2: NanoCore.ClientPluginHost 0x6a6b:$s4: PipeCreated
32.2.dhcpmon.exe.293f720.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
32.2.dhcpmon.exe.293f720.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
29.2.dhcpmon.exe.3a16662.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x14dd7:$x1: NanoCore.ClientPluginHost 0x21f40:$x1: NanoCore.ClientPluginHost 0x2bd92:$x1: NanoCore.ClientPluginHost 0x33cb8:$x1: NanoCore.ClientPluginHost 0x39c89:$x1: NanoCore.ClientPluginHost 0x416f7:$x1: NanoCore.ClientPluginHost 0x4c6d4:$x1: NanoCore.ClientPluginHost 0x58476:$x1: NanoCore.ClientPluginHost 0x6d94e:$x1: NanoCore.ClientPluginHost 0x95bb0:$x1: NanoCore.ClientPluginHost 0xa4ff0:$x1: NanoCore.ClientPluginHost 0xbd393:$x1: NanoCore.ClientPluginHost 0xe55e1:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost 0x14e04:$x2: IClientNetworkHost 0x21f79:$x2: IClientNetworkHost 0x2bdcb:$x2: IClientNetworkHost 0x33cf1:$x2: IClientNetworkHost 0x41730:$x2: IClientNetworkHost 0x4c6ee:$x2: IClientNetworkHost
32.2.dhcpmon.exe.293a6e4.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x9bf7:$x1: NanoCore.ClientPluginHost 0x19ead:$x1: NanoCore.ClientPluginHost 0x2705f:$x1: NanoCore.ClientPluginHost 0x30f83:$x1: NanoCore.ClientPluginHost 0x38ef1:$x1: NanoCore.ClientPluginHost 0x3ef0c:$x1: NanoCore.ClientPluginHost 0x469c3:$x1: NanoCore.ClientPluginHost 0x51af9:$x1: NanoCore.ClientPluginHost 0x5d8e7:$x1: NanoCore.ClientPluginHost 0x69736:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x9c21:$x2: IClientNetworkHost 0x19eda:$x2: IClientNetworkHost 0x27098:$x2: IClientNetworkHost 0x30fbc:$x2: IClientNetworkHost 0x38f2a:$x2: IClientNetworkHost 0x469fc:$x2: IClientNetworkHost 0x51b13:$x2: IClientNetworkHost 0x5d901:$x2: IClientNetworkHost 0x69773:$x2: IClientNetworkHost
32.2.dhcpmon.exe.293a6e4.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x9bf7:$x2: NanoCore.ClientPluginHost 0x19ead:$x2: NanoCore.ClientPluginHost 0x2705f:$x2: NanoCore.ClientPluginHost 0x30f83:$x2: NanoCore.ClientPluginHost 0x38ef1:$x2: NanoCore.ClientPluginHost 0x3ef0c:$x2: NanoCore.ClientPluginHost 0x469c3:$x2: NanoCore.ClientPluginHost 0x51af9:$x2: NanoCore.ClientPluginHost 0x5d8e7:$x2: NanoCore.ClientPluginHost 0x69736:$x2: NanoCore.ClientPluginHost 0x1ae7c:$s2: FileCommand 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xbaa7:$s4: PipeCreated 0x1f87e:$s4: PipeCreated 0x2717c:$s4: PipeCreated 0x31087:$s4: PipeCreated 0x3900c:$s4: PipeCreated 0x3efea:$s4: PipeCreated 0x46b0e:$s4: PipeCreated
32.2.dhcpmon.exe.293a6e4.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x9bd2:$a: NanoCore 0x9bf7:$a: NanoCore 0x9c50:$a: NanoCore 0x19e87:$a: NanoCore 0x19ead:$a: NanoCore 0x19f09:$a: NanoCore 0x26da7:$a: NanoCore 0x26e00:$a: NanoCore 0x26e33:$a: NanoCore 0x2705f:$a: NanoCore 0x270db:$a: NanoCore 0x276f4:$a: NanoCore 0x2783d:$a: NanoCore 0x27d11:$a: NanoCore 0x27ff8:$a: NanoCore 0x2800f:$a: NanoCore 0x30f83:$a: NanoCore
4.2.swift copy.exe.6cc0000.14.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x5b0b:$x1: NanoCore.ClientPluginHost 0x5b44:$x2: IClientNetworkHost
4.2.swift copy.exe.6cc0000.14.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x5b0b:$x2: NanoCore.ClientPluginHost 0x5c0f:$s4: PipeCreated 0x5b25:$s5: IClientLoggingHost
32.2.dhcpmon.exe.3a52894.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
32.2.dhcpmon.exe.3a52894.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8b7f:$a: NanoCore 0x8ba5:$a: NanoCore 0x8c01:$a: NanoCore 0x15a56:$a: NanoCore 0x15aaf:$a: NanoCore 0x15ae2:$a: NanoCore 0x15d0e:$a: NanoCore 0x15d8a:$a: NanoCore 0x163a3:$a: NanoCore 0x164ec:$a: NanoCore 0x169c0:$a: NanoCore 0x16ca7:$a: NanoCore 0x16cbe:$a: NanoCore 0x1fb60:$a: NanoCore 0x1fbdc:$a: NanoCore 0x224bf:$a: NanoCore 0x27a86:$a: NanoCore 0x27b00:$a: NanoCore 0x2c69d:$a: NanoCore 0x2da57:$a: NanoCore 0x2daa1:$a: NanoCore
29.2.dhcpmon.exe.3a16662.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
29.2.dhcpmon.exe.3a22894.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
29.2.dhcpmon.exe.3a16662.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4b96:$a: NanoCore 0x4bbb:$a: NanoCore 0x4c14:$a: NanoCore 0x14db1:$a: NanoCore 0x14dd7:$a: NanoCore 0x14e33:$a: NanoCore 0x21c88:$a: NanoCore 0x21ce1:$a: NanoCore 0x21d14:$a: NanoCore 0x21f40:$a: NanoCore 0x21fbc:$a: NanoCore 0x225d5:$a: NanoCore 0x2271e:$a: NanoCore 0x22bf2:$a: NanoCore 0x22ed9:$a: NanoCore 0x22ef0:$a: NanoCore 0x2bd92:$a: NanoCore 0x2be0e:$a: NanoCore 0x2e6f1:$a: NanoCore 0x33cb8:$a: NanoCore 0x33d32:$a: NanoCore
32.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
32.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
32.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
32.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
32.2.dhcpmon.exe.3a46662.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x14dd7:$x1: NanoCore.ClientPluginHost 0x21f40:$x1: NanoCore.ClientPluginHost 0x2bd92:$x1: NanoCore.ClientPluginHost 0x33cb8:$x1: NanoCore.ClientPluginHost 0x39c89:$x1: NanoCore.ClientPluginHost 0x416f7:$x1: NanoCore.ClientPluginHost 0x4c6d4:$x1: NanoCore.ClientPluginHost 0x58476:$x1: NanoCore.ClientPluginHost 0x6d94e:$x1: NanoCore.ClientPluginHost 0x95bb0:$x1: NanoCore.ClientPluginHost 0xa4ff0:$x1: NanoCore.ClientPluginHost 0xbd393:$x1: NanoCore.ClientPluginHost 0xe55e1:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost 0x14e04:$x2: IClientNetworkHost 0x21f79:$x2: IClientNetworkHost 0x2bdcb:$x2: IClientNetworkHost 0x33cf1:$x2: IClientNetworkHost 0x41730:$x2: IClientNetworkHost 0x4c6ee:$x2: IClientNetworkHost
32.2.dhcpmon.exe.3a46662.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
32.2.dhcpmon.exe.3a46662.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4b96:$a: NanoCore 0x4bbb:$a: NanoCore 0x4c14:$a: NanoCore 0x14db1:$a: NanoCore 0x14dd7:$a: NanoCore 0x14e33:$a: NanoCore 0x21c88:$a: NanoCore 0x21ce1:$a: NanoCore 0x21d14:$a: NanoCore 0x21f40:$a: NanoCore 0x21fbc:$a: NanoCore 0x225d5:$a: NanoCore 0x2271e:$a: NanoCore 0x22bf2:$a: NanoCore 0x22ed9:$a: NanoCore 0x22ef0:$a: NanoCore 0x2bd92:$a: NanoCore 0x2be0e:$a: NanoCore 0x2e6f1:$a: NanoCore 0x33cb8:$a: NanoCore 0x33d32:$a: NanoCore
4.2.swift copy.exe.5b50000.10.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
4.2.swift copy.exe.5b50000.10.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
12.2.dhcpmon.exe.47231b0.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.dhcpmon.exe.47231b0.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.dhcpmon.exe.47231b0.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.dhcpmon.exe.47231b0.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
29.2.dhcpmon.exe.3a16662.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
29.2.dhcpmon.exe.3a16662.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
29.2.dhcpmon.exe.29132a0.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
29.2.dhcpmon.exe.29132a0.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
4.2.swift copy.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
4.2.swift copy.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
4.2.swift copy.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.swift copy.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
4.2.swift copy.exe.43a6662.7.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x2dbb:$x1: NanoCore.ClientPluginHost 0x2de5:$x2: IClientNetworkHost
4.2.swift copy.exe.43a6662.7.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x2dbb:$x2: NanoCore.ClientPluginHost 0x4c6b:$s4: PipeCreated
29.2.dhcpmon.exe.291f56c.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
29.2.dhcpmon.exe.291f56c.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
4.2.swift copy.exe.329db14.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
4.2.swift copy.exe.329db14.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
29.2.dhcpmon.exe.3a11836.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x99e7:$x1: NanoCore.ClientPluginHost 0x19c03:$x1: NanoCore.ClientPluginHost 0x26d6c:$x1: NanoCore.ClientPluginHost 0x30bbe:$x1: NanoCore.ClientPluginHost 0x38ae4:$x1: NanoCore.ClientPluginHost 0x3eab5:$x1: NanoCore.ClientPluginHost 0x46523:$x1: NanoCore.ClientPluginHost 0x51500:$x1: NanoCore.ClientPluginHost 0x5d2a2:$x1: NanoCore.ClientPluginHost 0x7277a:$x1: NanoCore.ClientPluginHost 0x9a9dc:$x1: NanoCore.ClientPluginHost 0xa9e1c:$x1: NanoCore.ClientPluginHost 0xc21bf:$x1: NanoCore.ClientPluginHost 0xea40d:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x9a11:$x2: IClientNetworkHost 0x19c30:$x2: IClientNetworkHost 0x26da5:$x2: IClientNetworkHost 0x30bf7:$x2: IClientNetworkHost 0x38b1d:$x2: IClientNetworkHost
29.2.dhcpmon.exe.3a11836.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
29.2.dhcpmon.exe.3a11836.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x99c2:$a: NanoCore 0x99e7:$a: NanoCore 0x9a40:$a: NanoCore 0x19bdd:$a: NanoCore 0x19c03:$a: NanoCore 0x19c5f:$a: NanoCore 0x26ab4:$a: NanoCore 0x26b0d:$a: NanoCore 0x26b40:$a: NanoCore 0x26d6c:$a: NanoCore 0x26de8:$a: NanoCore 0x27401:$a: NanoCore 0x2754a:$a: NanoCore 0x27a1e:$a: NanoCore 0x27d05:$a: NanoCore 0x27d1c:$a: NanoCore 0x30bbe:$a: NanoCore
29.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
29.2.dhcpmon.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
29.2.dhcpmon.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
29.2.dhcpmon.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
32.2.dhcpmon.exe.293f720.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x14e71:$x1: NanoCore.ClientPluginHost 0x22023:$x1: NanoCore.ClientPluginHost 0x2bf47:$x1: NanoCore.ClientPluginHost 0x33eb5:$x1: NanoCore.ClientPluginHost 0x39ed0:$x1: NanoCore.ClientPluginHost 0x41987:$x1: NanoCore.ClientPluginHost 0x4cabd:$x1: NanoCore.ClientPluginHost 0x588ab:$x1: NanoCore.ClientPluginHost 0x646fa:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost 0x14e9e:$x2: IClientNetworkHost 0x2205c:$x2: IClientNetworkHost 0x2bf80:$x2: IClientNetworkHost 0x33eee:$x2: IClientNetworkHost 0x419c0:$x2: IClientNetworkHost 0x4cad7:$x2: IClientNetworkHost 0x588c5:$x2: IClientNetworkHost 0x64737:$x2: IClientNetworkHost
32.2.dhcpmon.exe.293f720.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4bbb:$x2: NanoCore.ClientPluginHost 0x14e71:$x2: NanoCore.ClientPluginHost 0x22023:$x2: NanoCore.ClientPluginHost 0x2bf47:$x2: NanoCore.ClientPluginHost 0x33eb5:$x2: NanoCore.ClientPluginHost 0x39ed0:$x2: NanoCore.ClientPluginHost 0x41987:$x2: NanoCore.ClientPluginHost 0x4cabd:$x2: NanoCore.ClientPluginHost 0x588ab:$x2: NanoCore.ClientPluginHost 0x646fa:$x2: NanoCore.ClientPluginHost 0x15e40:$s2: FileCommand 0x6a6b:$s4: PipeCreated 0x1a842:$s4: PipeCreated 0x22140:$s4: PipeCreated 0x2c04b:$s4: PipeCreated 0x33fd0:$s4: PipeCreated 0x39fae:$s4: PipeCreated 0x41ad2:$s4: PipeCreated 0x4daf2:$s4: PipeCreated 0x5a656:$s4: PipeCreated 0x67b4d:$s4: PipeCreated
32.2.dhcpmon.exe.293f720.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4b96:$a: NanoCore 0x4bbb:$a: NanoCore 0x4c14:$a: NanoCore 0x14e4b:$a: NanoCore 0x14e71:$a: NanoCore 0x14ecd:$a: NanoCore 0x21d6b:$a: NanoCore 0x21dc4:$a: NanoCore 0x21df7:$a: NanoCore 0x22023:$a: NanoCore 0x2209f:$a: NanoCore 0x226b8:$a: NanoCore 0x22801:$a: NanoCore 0x22cd5:$a: NanoCore 0x22fbc:$a: NanoCore 0x22fd3:$a: NanoCore 0x2bf47:$a: NanoCore 0x2bfc3:$a: NanoCore 0x2e8a6:$a: NanoCore 0x33eb5:$a: NanoCore 0x33f2f:$a: NanoCore
4.2.swift copy.exe.43a1836.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x99e7:$x1: NanoCore.ClientPluginHost 0x19c03:$x1: NanoCore.ClientPluginHost 0x26d6c:$x1: NanoCore.ClientPluginHost 0x30bbe:$x1: NanoCore.ClientPluginHost 0x38ae4:$x1: NanoCore.ClientPluginHost 0x3eab5:$x1: NanoCore.ClientPluginHost 0x46523:$x1: NanoCore.ClientPluginHost 0x51500:$x1: NanoCore.ClientPluginHost 0x5d2a2:$x1: NanoCore.ClientPluginHost 0x7277a:$x1: NanoCore.ClientPluginHost 0x9a9dc:$x1: NanoCore.ClientPluginHost 0xa9e1c:$x1: NanoCore.ClientPluginHost 0xc21bf:$x1: NanoCore.ClientPluginHost 0xea40d:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x9a11:$x2: IClientNetworkHost 0x19c30:$x2: IClientNetworkHost 0x26da5:$x2: IClientNetworkHost 0x30bf7:$x2: IClientNetworkHost 0x38b1d:$x2: IClientNetworkHost
4.2.swift copy.exe.43a1836.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
4.2.swift copy.exe.43a1836.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x99c2:$a: NanoCore 0x99e7:$a: NanoCore 0x9a40:$a: NanoCore 0x19bdd:$a: NanoCore 0x19c03:$a: NanoCore 0x19c5f:$a: NanoCore 0x26ab4:$a: NanoCore 0x26b0d:$a: NanoCore 0x26b40:$a: NanoCore 0x26d6c:$a: NanoCore 0x26de8:$a: NanoCore 0x27401:$a: NanoCore 0x2754a:$a: NanoCore 0x27a1e:$a: NanoCore 0x27d05:$a: NanoCore 0x27d1c:$a: NanoCore 0x30bbe:$a: NanoCore
4.2.swift copy.exe.32918cc.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4bbb:$x1: NanoCore.ClientPluginHost 0x14ded:$x1: NanoCore.ClientPluginHost 0x21f67:$x1: NanoCore.ClientPluginHost 0x2bdc7:$x1: NanoCore.ClientPluginHost 0x33cfd:$x1: NanoCore.ClientPluginHost 0x39ce0:$x1: NanoCore.ClientPluginHost 0x4175f:$x1: NanoCore.ClientPluginHost 0x4c751:$x1: NanoCore.ClientPluginHost 0x58507:$x1: NanoCore.ClientPluginHost 0x64296:$x1: NanoCore.ClientPluginHost 0x4be5:$x2: IClientNetworkHost 0x14e1a:$x2: IClientNetworkHost 0x21fa0:$x2: IClientNetworkHost 0x2be00:$x2: IClientNetworkHost 0x33d36:$x2: IClientNetworkHost 0x41798:$x2: IClientNetworkHost 0x4c76b:$x2: IClientNetworkHost 0x58521:$x2: IClientNetworkHost 0x642d3:$x2: IClientNetworkHost
4.2.swift copy.exe.32918cc.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4b96:$a: NanoCore 0x4bbb:$a: NanoCore 0x4c14:$a: NanoCore 0x14dc7:$a: NanoCore 0x14ded:$a: NanoCore 0x14e49:$a: NanoCore 0x21caf:$a: NanoCore

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report swift copy.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs