Extracted

• • Target

    RNSM00474.7z

  • Size

    66.2MB

  • MD5

    dd4d8150f7e6c0f228be9a3a86e2aef7

  • SHA1

    6afcb1e7476d2bcc4b3d5019f620c0feeb929c0f

  • SHA256

    c25b8011aaa30aeda483c227f1147ce1dff248e0eeacc2939c9b9c7b9194730d

  • SHA512

    6a4e25fe505c942e25e6a13c356b4c2bad946210274585986b8f3a20ee1b794ac63516b4ea699f4cf560d9c8c352e378314c2b6a467c7639b5e06744425bba21

  • SSDEEP

    1572864:uIXZWY5O+pQmc2D0cJw23RtlCuFQVd+scH//rmzZO/QQPW9c:TPpQAYdYHQOswzn

  Score

  10^/10

  nanocorexmrigagilenetdefense_evasiondiscoveryevasionkeyloggerminerpersistenceransomwarespywarestealertrojanupx

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Renames multiple (92) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • XMRig Miner payload

    miner

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • System Binary Proxy Execution: Regsvcs/Regasm

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1