Extracted

• • Target

    95107cbf8e5e80e92bec2ad6da134b55944850fd5306f64efa56cc9dea4a817a.exe

  • Size

    1.3MB

  • MD5

    ec336866176c93a6e9193bad24adea51

  • SHA1

    c9afc56751158d78029deba3afab3ff823a0c2c5

  • SHA256

    95107cbf8e5e80e92bec2ad6da134b55944850fd5306f64efa56cc9dea4a817a

  • SHA512

    678f47cfefa7204b773e1ff4b3dee76a88aedf3fa7bdebabc278c9e2c006c265e3c5b1d7cc0c3413177428b1b45cdb209a9a1a85ab98c181bd28da899c56669c

  • SSDEEP

    24576:BUS/d3xKzks2ks2y8jgES2zzEQvzLKcLAbvJy8N6ZNqZ:DKnwEPzzNvzLKCAblN6ZNq

  Score

  10^/10

  nanocorediscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2