Extracted

• • Target

    JaffaCakes118_12897cc89f6a46e25f9d5445e9299003

  • Size

    1.0MB

  • MD5

    12897cc89f6a46e25f9d5445e9299003

  • SHA1

    6b3d478c2895cccbf8bfd6135338e517bb20707c

  • SHA256

    f7943cf69c4834c48a432c2a76caa9eecc80fa9fffdf5868277556c6d3fefd64

  • SHA512

    0baa5d19ae88a4bab3d512717e0ea27d6d3edcd4ea67712e90c0d5b0013e3fe6315e138514fc4bb39f07af27e58d669ca87ea7126edf43990a44fafa1d64514f

  • SSDEEP

    24576:jWFOB6AlAlKal/zPsKuLubbXwUv8hzZhg3+TE/+PnyuXzhU:zB6Y1O3yAwUkhzXgOTaYnyq

  Score

  10^/10

  nanocorediscoveryevasionexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2