Extracted

• • Target

    b2c04bb4-1039-4836-bca6-bd4211df1190

  • Size

    524KB

  • MD5

    81ffddf2c1d7905204a67f6577e2dc68

  • SHA1

    a89c37a3e12a46ac714887d509a1849791b4b244

  • SHA256

    5713df54ae15a1a47a87436d1c7ddc06338f9c31276880d6d2ae29d2655313e7

  • SHA512

    b871a001fa251a9af36788ceda94ece6772a5f318120db5cada7643e66da7978d0a0f373ab271c15b45a0947f1161ee60284c0621e25e07ea81864a3c8945e4a

  • SSDEEP

    6144:dLeno+U3zituONCfDq/ib4IKEQwpUgQ/Fn7r+DHZ8q6PTZKWCaYVZ6qXW4bPwDJr:sRC+ab4aQlhFnPA81X/Y1cNm+1v6pP

  Score

  10^/10

  nanocorediscoveryevasionexecutionkeyloggerspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2