Extracted

• • Target

    27b04b42d5706f5e29f7eb80e232d6d0N

  • Size

    282KB

  • MD5

    27b04b42d5706f5e29f7eb80e232d6d0

  • SHA1

    8baddc8fe43478936c7b3571468be68832b03890

  • SHA256

    536487a863b91906226c0697373b5374e78246dc58bcb9afa281676901080277

  • SHA512

    1167d68007e053b89038796203757424fda5fe2387748ba3dfbecc26107c91cbe958ef2c8bfdea302e0fc5b2c312529d802a6b931f8cc3809a754399b9aef7e8

  • SSDEEP

    6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfz:boSeGUA5YZazpXUmZhZ6SS

  Score

  10^/10

  discoverypersistencenanocoreevasionkeyloggerspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2