Extracted

• • Target

    PAYMENT_SWIFT_DETAIL_ORDPAY_911_5.exe

  • Size

    936KB

  • MD5

    eba49d349d1d71f31270380179c4d88c

  • SHA1

    dd6af373b9d6671d3c6762567ec962040e3afefc

  • SHA256

    2a6626eb860702da5f9cd211f8ed7b8d6a030fbc2ad03d7c012297d8b62653fc

  • SHA512

    42ce5fbf900694402dbf03f3a16bb863493b00be3893ba257c96874facbd17414f442aa609e89897a41fd18ddc6c33a0991a2e7389f63e7128e5a9934f99ccc7

  • SSDEEP

    12288:zPNR/4veociDOVJHuQJsi7Nu5pRMezATUrVmL+aX:TL4veniC3uQP7cbRDUTU8

  Score

  10^/10

  nanocoreevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2