Extracted

• • Target

    fdbaf1cf150f8ce9892cd77f8f57ee3a_JaffaCakes118

  • Size

    2.3MB

  • MD5

    fdbaf1cf150f8ce9892cd77f8f57ee3a

  • SHA1

    30b9e7f9fd621887cc3c0d386e8f39e2d5c82229

  • SHA256

    2d68a08146c225053c8314282aca4053408e85ff77a9bbd302efe44f1db4739e

  • SHA512

    1c9b52214898992d138da884da8c360eb8a40aabb3fa8b9027bcc93686d4f1df2a77f00ecc75944eec063e896b65bc70d1e0c865c6a51e03f1894a4838a75caa

  • SSDEEP

    49152:qAoTSV3SSpwtb9rRbipPihj+dPGyFUJ8pg:qnu3nERmpPiF+9GyFUJ8K

  Score

  10^/10

  nanocoredefense_evasiondiscoveryevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2