Extracted

• • Target

    2BAD850D4FC1355D5CBDEF48A773968DFD53BAE047865.exe

  • Size

    4.7MB

  • MD5

    4efc94d8768163a6e25a53e7d002e962

  • SHA1

    35bbd174ee8a9dc8b269b3bcb2ef42f468af6e43

  • SHA256

    2bad850d4fc1355d5cbdef48a773968dfd53bae047865fe20b131bcf854eb833

  • SHA512

    bafb841aeefc403984cf3236db92ee4a6e4cc0a5b772b7869bf3b604094db39323bb4315cd98a5832ba341023464717ecd9a30e66f62f1dd03ba0031944feb3b

  • SSDEEP

    98304:JAB7bQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:u7CzUcwti7TQlF3ZxxWJSUnDv

  Score

  10^/10

  nanocoreevasionkeyloggerpersistencespywarestealertrojanupx

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies security service

    evasion

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2