Extracted

• • Target

    bbe4ba566d229a405da3af72193d297f.exe

  • Size

    1.3MB

  • MD5

    bbe4ba566d229a405da3af72193d297f

  • SHA1

    ffb73821d698bc2e32f1a32c7adf95e66520c7a8

  • SHA256

    aeb8e080b996a75f85bb82e2e7a42d0302735713f34fb95fff1bfb97a030e107

  • SHA512

    a3ba9225b2719f482f807fe91217cdccbb9c415d54a8cd4531960bf20456868ba7fb1be2e473c26f306c33b74615a6f5192f0c852dca25c66e6d63a4cbb25529

  • SSDEEP

    24576:8ixNAopnJcU4TgHosbIY95AcS1h9VOzYJ0Natxb:8iFpnx4TUosbIYEcSGQ06

  Score

  10^/10

  nanocorepurecrypterdownloaderevasionkeyloggerloaderpersistencespywarestealertrojan

  • Detect PureCrypter injector

    loader

  • Modifies WinLogon for persistence

    persistence

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2