Extracted

• • Target

    DHL_document11022020680908911.exe

  • Size

    215KB

  • MD5

    f5740e959f892407f13054de42748917

  • SHA1

    ff4f01986dae809ebfbb807fbc88301dd5e7a23a

  • SHA256

    8bd97a0d17f61d747de38b520274c6afcb52cf89ce87a1818866428f1416ef1c

  • SHA512

    8172375d875d13c37f47bef437eb7bb46c92c57fabe01b67976d557bfcca42ff142b2194b3a675dd4bb6808b73a454984963784741fe3e3a0763e3d7d52d7b60

  Score

  10^/10

  nanocoreevasionkeyloggerpersistencespywarestealersuricatatrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Turns off Windows Defender SpyNet reporting

    evasion

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • suricata: ET MALWARE Possible NanoCore C2 60B

    suricata: ET MALWARE Possible NanoCore C2 60B

    suricata

  • Nirsoft

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2