Extracted

• • Target

    JaffaCakes118_80f94757cfd5b5b38166a418981980bc

  • Size

    1.4MB

  • MD5

    80f94757cfd5b5b38166a418981980bc

  • SHA1

    c1ea391c79a64a4a9b012d382cc8a5849d76a501

  • SHA256

    ccce490c8fc044035705bad347b0a7d41353fc9c2e7b95d7035b394f988d16d4

  • SHA512

    8ff3285de18857f9560d288775cb11900d194cf0f23c6cd1459ce390ebfd367aa70e75b96617b385939c7ce30121387ed407e3a05d6a9aa9d55a363c9583af35

  • SSDEEP

    24576:rAOcZEhNWxlG7m4/9eBcA4CCEti0POqh/0rEOTq6ai0bagi7xa53:tyxlk9eBVlCGVPOwOTq6d4a5wN

  Score

  10^/10

  nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2