Extracted

• • Target

    ae1265e9fe0ac39bbe970a3fa66c64b0N.exe

  • Size

    282KB

  • MD5

    ae1265e9fe0ac39bbe970a3fa66c64b0

  • SHA1

    9239a5d795a2d97e72e7bd9b48b125d0e2459960

  • SHA256

    87a574cbf6233e2fd7a3872da22451ae49f6248cca5c900dab49207e0f0135b0

  • SHA512

    ff66d820fd16cc06ee99b995b1de7aa22d545da35518a1b02c5d5dee6a2d6c8670d3c3ba6934c0f0ebeaadb577c9de91dd9db8f8b27d1636f4f7514a6b4430a5

  • SSDEEP

    6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfQ:boSeGUA5YZazpXUmZhZ6Sp

  Score

  10^/10

  nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2