Extracted

• • Target

    323eb7cfdda6b481d8365875bae6bac7_JaffaCakes118

  • Size

    956KB

  • MD5

    323eb7cfdda6b481d8365875bae6bac7

  • SHA1

    b52d8bf673c8dec9fda605c4def937478ca38e48

  • SHA256

    b60e40f3eae92cac6a2d803b06586b7fe63d30dcfa37858a5e0e7226307139fb

  • SHA512

    5269e0c117206b08831c9f269994c48b823b5765f9d4382a968960718e6741cf3de38a75d161068b8bfcd233cb77a77aa8ead6b09f558f9bb7ff4038a0a5722d

  • SSDEEP

    24576:9IPp9AR95SDxKE69t8vl+orJpJ31nTcf3drEbIQfKkB:9IPpKRSDQh8Trx9TnI

  Score

  10^/10

  nanocorediscoveryevasionkeyloggerspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2