Extracted

• • Target

    dbf4194e27254f56ff4c456a2a2ca07c7a2a4432553c013e50724a0f31017727.exe

  • Size

    1.4MB

  • MD5

    4cb7425442688fe6a78d203dbb8b2ade

  • SHA1

    07e898706bba2fad06868827397cba204bc4c983

  • SHA256

    dbf4194e27254f56ff4c456a2a2ca07c7a2a4432553c013e50724a0f31017727

  • SHA512

    ef39c104e2de10eb3c1466669af99f6fb0aad03f23ad4a253a7aaf2c885046f9ceef0bb3a2458739f13572eded6b865c5581a078f5b361bb09f6f8535f525711

  • SSDEEP

    24576:rAOcZEhNWxlG7m4/9eBcA4CCEti0POqh/0rEOTq6ai0bagi7xa53:tyxlk9eBVlCGVPOwOTq6d4a5wN

  Score

  10^/10

  nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2