Extracted

• • Target

    DHL-#AWB130501923096PDF.exe

  • Size

    712KB

  • MD5

    13e8443bf19ea588b2c7a77251746fe8

  • SHA1

    62ae36fa6f7d5a21e026a8bbebed94bac81384e6

  • SHA256

    1372611a62207431985055ea8ecb4121b3dfb199e615102c06cc38e5aabdd65d

  • SHA512

    0dbcf414e821c737084e2d3cc378f5e8de1920ab2d41340d5c474316a051001f71cb47f0733cb588923d885455137c2b36993caecb160333bc23e539b9db6de9

  Score

  10^/10

  nanocoreevasionkeyloggerpersistenceransomwarespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2