Extracted

• • Target

    542fa105a341f8ff4063b89dd3299e22_JaffaCakes118

  • Size

    609KB

  • MD5

    542fa105a341f8ff4063b89dd3299e22

  • SHA1

    f04e625d862613b9cfe5c475b026210973350186

  • SHA256

    e7c691d0c52249f5b1e3b51dc9034b5cf08eed17bf3980e0929ee237fab9e646

  • SHA512

    67c7203c1211a55594556632719afc5b9d2e39a848f7bd384a2dbafc45f23da6f158fa354cfdd7149d3ef17859198cc8e0903c8be81c9f6080d81dc239906880

  • SSDEEP

    12288:k8oXpPXHbsQNcHdMZTBTwRnwZ9AJT6YashlM0JT6YashlM:5ApPw1HyZcyM9ashlV9ashl

  Score

  10^/10

  nanocoreevasionexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2