Extracted

• • Target

    4a36eccbb48f54d243b7982530cfa61b_JaffaCakes118

  • Size

    903KB

  • MD5

    4a36eccbb48f54d243b7982530cfa61b

  • SHA1

    fbf72fc16184a18f6a15800daa1e828a514fc392

  • SHA256

    eb2c54829751a21c9865767bcd7056892a02a66f73bf39c2c07a1eb6e3ea5599

  • SHA512

    db680deea1b90f6457c840195f33c36ddf851e05e807d5f6e1f8fca26bdd180a56826db80916e9e1146845a78e3026d6d0f1e5ee25304829828847a40fb4a520

  • SSDEEP

    24576:yJKuPp9AR95yTbUwK/blz88KCw/fLZ1R5:8PpKRyTbUwGlUfF1R

  Score

  10^/10

  nanocorediscoveryevasionexecutionkeyloggerspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2