Extracted

• • Target

    PO#4018-308875.pdf.exe

  • Size

    627KB

  • MD5

    ea28f2d01808072dbe45804f514ef905

  • SHA1

    771ff981d42d6c7fc3550de8cb109e3311b0e0fa

  • SHA256

    618d343a6d7f54a0bfd917555c79c6a777b10a35fc2da0d75f6d85354de40637

  • SHA512

    14c8f4c649f60238a1398bf28cd8a1a1c94d14b74d888a26bca537317de1d1beada94a6fdb5d51a3ad30ee4c07e389e0fe6eb988e29df485808fd19114715d16

  Score

  10^/10

  nanocoreevasionkeyloggerpersistenceransomwarespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2