Extracted

• • Target

    JaffaCakes118_ce6c1427a68e923224e5b905c111a705

  • Size

    637KB

  • MD5

    ce6c1427a68e923224e5b905c111a705

  • SHA1

    5edea42e155b4ee11df0d4ff92cdc8e9f1ba0a98

  • SHA256

    4a3c5b05acf2b9146986099a82aff6b616442d38222aa5be8ab875e1a73be94e

  • SHA512

    e0cac17621e0913bbb7f11be8d139cf674c55b0eab16b84c44c111c38be641466d2530fc349513ebe56cca110d1ce10d287055d44986c0d3600700e4a18102ea

  • SSDEEP

    12288:OJ9XIX7zoGgSwSsX+m+R+BFb20WWf+or5FbnVe:OfXG7pgNt+R+Pb20WWx

  Score

  10^/10

  nanocorediscoveryexecutionkeyloggerspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2