Extracted

• • Target

    2024-10-25_5f6b7ad587ec1fe9c1afdfb1bc12463a_snatch

  • Size

    2.1MB

  • MD5

    5f6b7ad587ec1fe9c1afdfb1bc12463a

  • SHA1

    b53bc71f7e1bb23378c18856cc038c6522cd1441

  • SHA256

    80518576d0012cbaafa633be79c472de9fb46c0484cd238c8d8cb0d7f2dac02d

  • SHA512

    bf11b1199950cc9d3f7444e22050ab424add02b663cf7c034fb9c27ba0428ee4f4866d89081eea9103ffc9eec6ce0bb7c6a5cd926f2b9d6ed4a51288ff902b24

  • SSDEEP

    24576:dYDqXSb84KRDMNR9r0hLxAnLGzOnqNDD+tJjEYGpUU3e4q+CjL71FL38D1PKMeY8:dYJr0G2xYGpUMqv38D1rUdFmH4

  Score

  10^/10

  nanocorediscoveryevasionexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2