Extracted

• • Target

    RNSM00345.7z

  • Size

    3.0MB

  • MD5

    2936f6c721739b8fb55452e0916e6e1b

  • SHA1

    47c23c9bf2692ea1cab5a0f6f59fd47f6da642ea

  • SHA256

    49c4f9e21ec3b698c60215cb6072f73f25b6d7dd09064be86e1dfc184f50b06c

  • SHA512

    f4874e79a8b69d8bd46e6b261e8b42aa557e11ddb328e0cf1901c9dd265e8c321e1a42cb0a060a0e99400b7f0af5c85abf70348206a8659fa465fdf879bf1016

  • SSDEEP

    49152:91t6JJ+UADa5weGrqFva0dVF6xfikl/Jcjdh9vS44IVJeQz1JkRKpUg3oEaL:9LeA+GeHlL0iSqjdbvST4JR1pGEaL

  Score

  10^/10

  nanocoretroldeshdefense_evasiondiscoveryevasionkeyloggerpersistenceransomwarespywarestealertrojanupx

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Troldesh family

    troldesh

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • System Binary Proxy Execution: Verclsid

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1