Extracted

• • Target

    a785d83754fab56e2e0b55490686584b_JaffaCakes118

  • Size

    722KB

  • MD5

    a785d83754fab56e2e0b55490686584b

  • SHA1

    8e4fafdd41ebfa609607debb83681b99a777ab10

  • SHA256

    6d16110bddc20d35d1b19fb6cfc9521c78b56d2eb9f57e27da3e62461b0cef01

  • SHA512

    7979858efdca6b4e174d522a57356e2b08b6c446cce4658f6911fcc84c3d43934360a844af4ba2ab7a5ff49dee82fc920480f57826cc293a0fb81f1d0e84218c

  • SSDEEP

    12288:MbQ+X8+UiDLbRHahXUy/v0bp36JI0Vj9jQBbE8T+JBenCBiHMFlx:MbQ+X8+UiDLbRHahXUTl3UxQBb1THYRl

  Score

  10^/10

  discoveryexecutionnanocoreevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2