Extracted

• • Target

    945bf76fc6fa7ec4590c1eb31d91626cd303e375aed453406585a8e976196d76N.exe

  • Size

    281KB

  • MD5

    e996f39dc7aaedb7708907aa52dd8fd0

  • SHA1

    df690b3f42a2a9d2934730976bcb267994e99948

  • SHA256

    945bf76fc6fa7ec4590c1eb31d91626cd303e375aed453406585a8e976196d76

  • SHA512

    d3cf6bf102fbb47e79d104f6c73696a73b625e8c1680573cd22d9cd206795eae7d10c02ff1c7c09387264094bd51aa7501819f8ab181db4217b3218e8636ebfe

  • SSDEEP

    6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66f8:boSeGUA5YZazpXUmZhZ6U

  Score

  10^/10

  nanocoredefense_evasiondiscoverykeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2