Extracted

• • Target

    AHF PO 00035440PDF.exe

  • Size

    498KB

  • MD5

    1ea3b1a102cee26912254a6a1e2dc627

  • SHA1

    635ea4fe2d801ffcbdb2284f74fdd78c9c4ed795

  • SHA256

    4329ace3154dca4e544733d0f2f10abc543755dde977d9bb6998fb7368186bb8

  • SHA512

    e63c4b691e9618f6f86097f71b75083d8cc507a20c5e8a1b4fbd513fd01d0c2a909ba4585f56bcbb566bafd06293b2afdfcb0974f254152b295a9b1ad46dab61

  Score

  10^/10

  nanocoreevasionkeyloggerspywarestealersuricatatrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • suricata: ET MALWARE Possible NanoCore C2 60B

    suricata: ET MALWARE Possible NanoCore C2 60B

    suricata

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2