Extracted

• • Target

    Jako Gen Source Code.exe

  • Size

    203KB

  • MD5

    cf4eb39d02324430fde9a09b0c36e321

  • SHA1

    5c6e77058e920d61ba74207027df073763905310

  • SHA256

    e8713b84ea80e0553edb04dfbdcf5feb8d5ff57ee116c5f77e092b08a9898f8b

  • SHA512

    332b5f3e25db8771b8f7afd9ded17e13e40bfa606377f4ba3531e46d9a6f080e81d7b826e8a5631b7131d50141e901d269cd78d595255705fdd390439b6bfaec

  • SSDEEP

    3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIq3grv/ZCSAjdcedtBWn6BXiLL:ULV6Bta6dtJmakIM5LISpWbBNV82UG

  Score

  10^/10

  nanocoreevasionkeyloggerpersistencespywarestealertrojandiscoveryprivilege_escalation

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2