Extracted

• • Target

    fe336762e80da2b170280a2b1b836d90N.exe

  • Size

    640KB

  • MD5

    fe336762e80da2b170280a2b1b836d90

  • SHA1

    55a234638622e0e67d380cc7f827e71a88ffcba8

  • SHA256

    73faac219e34398e37026d1bebc1bb198a833ce5a97de2b56dd2a723d27456f6

  • SHA512

    052966fccf969a883f8a12a0681d089d3c137dc444ff4df8d3b4dca1f8fce1196fb7ff411f0577ae1faea9b07284e9edd49226124c9cb22e4701829e7337d44b

  • SSDEEP

    12288:b7WYyKnpG9iNdeK0xrhslCO3hF/+iX11Cj0hxIB6XTyG:b7WY1mrmh3Dn0ghxMcTyG

  Score

  10^/10

  nanocorediscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2