Extracted

• • Target

    ea184a14a40394f152e2c08eb9ba62ee_JaffaCakes118

  • Size

    530KB

  • MD5

    ea184a14a40394f152e2c08eb9ba62ee

  • SHA1

    80a98688698a29681588d5fa23382b1fa33279b5

  • SHA256

    46a8154f10cee5ed12613adee278ae790a10b359191ce045e94d0d8191f1389d

  • SHA512

    d0232a2e16c8bf3e160446ee139c23ee0562b0e0161aa1153af84452be0db7a859a5a27e9e1f917186b25339f9be1a298218d21021f12a5758d07e0ff3156ac6

  • SSDEEP

    6144:GrtIRxHou3JQW6ioI+CCeNsHLFwoRgv/uxEj0qqVqOjgsVP/RG4vDuK8tFAnpLLC:GORP36Wz8CCeMF5s2jBLG4buJgtY6qZ

  Score

  10^/10

  nanocorediscoveryevasionexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2