Extracted

• • Target

    8685ccda6ee6e4efcb14a32552080b952d461f8a8baaae241ec994b44b837733N.exe

  • Size

    524KB

  • MD5

    c57570dcacafd7fefa561d7f5e9c6210

  • SHA1

    a2bd17084085a4b46c0cd2712960a3f82892db52

  • SHA256

    8685ccda6ee6e4efcb14a32552080b952d461f8a8baaae241ec994b44b837733

  • SHA512

    20e02a231249fca0a9ec5b0f9900c38b6586e8915645b29b2ac973b27606fc3a285521a2195d13e7ccd86d067aecd368b9ef13984aff204814094a62cdd0dc0a

  • SSDEEP

    12288:bhxp3lZnT9bDkCl3PX0jMCmvpKxZ86rDitP:bJlh9bDkClMjlmvpNgDiB

  Score

  10^/10

  nanocoredefense_evasiondiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2