Extracted

• • Target

    4ba3120b20dadb2ba430ca2bb5cb492bf0adbb4a6685c4c757086e6f46d5d607

  • Size

    399KB

  • MD5

    153deb0e0ffc0b476d5bba8a69778dde

  • SHA1

    4ef44b30281e61ffdb74c4b3c0ec5e5bab8fa08f

  • SHA256

    4ba3120b20dadb2ba430ca2bb5cb492bf0adbb4a6685c4c757086e6f46d5d607

  • SHA512

    00f58ffa67c2ee992f1904a3a923e80ee350956b4690eadd9dbfa8b4e6897ab4d598493f1bca3781cca0849184a3a40f21424efcc3e90d436d76540da5a89bf4

  • SSDEEP

    6144:GSI/6NlBkO6avy/eiZ8y6lT+taYVZOq/y4bRwDJm1RU78h1ixeRd7:GSO6NlBkO6avy/eySdYNaNm1RU7vxC

  Score

  10^/10

  nanocoreevasionexecutionkeyloggerspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2