Extracted

• • Target

    b08b3e32d70824efc376be391784dc48_JaffaCakes118

  • Size

    1.1MB

  • MD5

    b08b3e32d70824efc376be391784dc48

  • SHA1

    5697e5cbdf89875fcde4e0138502e2c5fd5c2158

  • SHA256

    cb3ec57389ef463a58a5721042355cda8d227c151ea528e949817534e214bdc8

  • SHA512

    316887470946ab9d046d290f4ff4f7bc2dae1039e48d0c9d614992e23e56b6354260b8c477f374035aa68f2c2d28cd65c4cb46c20c3d34f6696bf65619eb08b1

  • SSDEEP

    12288:6BkjXoeDZJ7Y4jhWaItUs9jS4/lMmmGvgwV9iSCnnRs3bCa8QHmaqOY3haOp9nHP:6CXo6ZVY4jqS5Q81RsfHmkY3t6L

  Score

  10^/10

  nanocorediscoveryevasionexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2