Extracted

• • Target

    XtasyExecutorV1.0.exe

  • Size

    203KB

  • MD5

    b8fb078ab0ff9ca107d79112a1a56255

  • SHA1

    cebcb36d55bb63688bd9ffbf7d372ba41b0e959e

  • SHA256

    2d73aa44284a435c2cc78b6a80a4326f42a28dfa598e5dfd20ba3f612afdcd37

  • SHA512

    1a817eb1043122eb183821558cd9541f4a34f76551f52040f8c2e3caf8dd082a88d80799be868bbb84fdf339cb462a63bb14bceae869345485b565a19d01f1f9

  • SSDEEP

    3072:AzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIseXxluxTkQ0yyMH+elFEGxdb8:ALV6Bta6dtJmakIM5NhkQl3EGrbmMZ3k

  Score

  10^/10

  nanocoredefense_evasiondiscoveryevasionkeyloggerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies security service

    evasion

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4