Extracted

• • Target

    a3b66fd528f2728fad40ab4eb46c8f1fba303b2c3ca54088fff6223da96c483d.exe

  • Size

    931KB

  • MD5

    691f6cb0459f268016ad101cf6158dff

  • SHA1

    da86d59a096e32846efb61b1ce55d1a5dbb1cb02

  • SHA256

    a3b66fd528f2728fad40ab4eb46c8f1fba303b2c3ca54088fff6223da96c483d

  • SHA512

    a09174c91dfc3ba00b792aed4b0b8eb4e5244d6590a71cdf81a884634ce124b85003a49aa7bd5cc0784a993c9b0c8d00f9bef614b3dcda8faf57dd65b4e2635e

  • SSDEEP

    24576:m8xWi7p5e9XwX6n+aV6b/XOyc2JfWz13jO:m0WiDOgXc+aVqCj

  Score

  10^/10

  nanocoreexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2