Extracted

• • Target

    33ea695c5aae0047ddbd1144eeba659a_JaffaCakes118

  • Size

    745KB

  • MD5

    33ea695c5aae0047ddbd1144eeba659a

  • SHA1

    0d1c55bd6977533133e285f4820c141e33dee792

  • SHA256

    13fe4c9b3cf5ae9a331e296d91c684470db23be83e0a981cdfe48d5d08b197bf

  • SHA512

    b80e9bba56b136e733845564ad6c7242e5a37239aafb6f1a093708d09b8d8741db247766288435f4bf6606265d913b0636cdbeffa8498ebc6200bdc124440d45

  • SSDEEP

    12288:HFUk4olor5jDTi3KT8BmPJeXnomQY4CDWOvngDFHSYi0HK7zGzJym19oSuj+u76F:wzwQJeKYXlYkIyXSuSs9/Zs9cQrumQHk

  Score

  10^/10

  nanocorediscoveryevasionexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2