Extracted

• • Target

    3035705002f46bc1ca67407006490b442059ea822d60c68b801b27c332638322.exe

  • Size

    1.4MB

  • MD5

    c573d8c93af3e0867a7f8365e8d56882

  • SHA1

    d9228e8d9da76a70caa9d879dbe42d35796473af

  • SHA256

    3035705002f46bc1ca67407006490b442059ea822d60c68b801b27c332638322

  • SHA512

    51b406a946a06dd0474728e89473a76db4951e402f97081505ab6f94e92ff2e534f8057a248a4a92d4acab99d5ea33b89d03fab073ef736a9b8616f0cb52c159

  • SSDEEP

    24576:rAOcZEhNWxlG7m4/9eBcA4CCEti0POqh/0rEOTq6ai0bagi7xa5S:tyxlk9eBVlCGVPOwOTq6d4a5w8

  Score

  10^/10

  nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2