Extracted

• • Target

    JaffaCakes118_201e9ae321377c18400c09ff75c9aee6

  • Size

    1.4MB

  • MD5

    201e9ae321377c18400c09ff75c9aee6

  • SHA1

    22402aee8967bb97e65cdc7a2b1fd051d4599bba

  • SHA256

    d0086a02cd46959e9e0e7309a97a5ab08ff482262406bfd7e35fe6351f98c124

  • SHA512

    1a865fadc93b6f95554ca6940712b181f057da66ac73e28c22fe1f1838cd12016f28ca5f05241a3f4778d34609e857913c3e1063f59ce3ba9ea7ac5d0a5909d4

  • SSDEEP

    24576:rAOcZEhNWxlG7m4/9eBcA4CCEti0POqh/0rEOTq6ai0bagi7xa5C:tyxlk9eBVlCGVPOwOTq6d4a5w8

  Score

  10^/10

  nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2