Extracted

• • Target

    2025-04-05_5a42731e84f6264b40a9fc8d5f527a0e_black-basta_luca-stealer_metamorfo

  • Size

    1.3MB

  • MD5

    5a42731e84f6264b40a9fc8d5f527a0e

  • SHA1

    c9cd62e51d2ed4feb92582b88a9f9b25b890c3ca

  • SHA256

    da277087425deecdf94e54b44bdf2df5042d4a65cc97b2b958876d528b2b850e

  • SHA512

    77972bd5a3c99922dd6aa25cebb0d5252280228864a3d8763bb40c67257f5d6bdfc31d67c697c28b528b9a7eeaab5aad8f99c481ab288aa99f9949d839daa230

  • SSDEEP

    24576:6NA3R5drXvd+CPORdlivNuFrNT2P9Z0+4sHVu1h6LId7nT1RMwaMm3CfBomuaSh:z5FdcD2P9Zzrc1h6LIdzTXM76fBo3aK

  Score

  10^/10

  nanocorediscoverykeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1