Extracted

Extracted

• • Target
    dae8588b604d0728a1a1ecc77096197a34ed1b22ae7de.exe
  • Size 38KB
  • SHA256 dae8588b604d0728a1a1ecc77096197a34ed1b22ae7de69a53f39b59e6574ffd
  • MD5 5445831cb11ab4ff4c277fb33247e58c
  • SHA1 b0ab44b2c005fc2d388a40e477bc70c4bee2f572
  • SHA512 92cfcad7a60f31c6a729f62857be083ce82ff00b1cd0942b354bf486461a5645844f73637f04cfebee0e5c3968971286c4adf8f75a1dd047e0000f8671f07e96
  • MD5 SHA1 SHA512

  Score

  10^/10

  nanocorexloaderefa8evasionkeyloggerloaderpersistenceratspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2