Extracted

• • Target
    https://wetransfer.com/downloads/15f451dc9e5d1d9c74f27f15d720eb1620260628175407/4cfb1d?t_exp=1782928447&t_lsid=fcaddb86-4c46-4404-b859-4e914e080f1d&t_network=link&t_rid=ZW1haWx8Njc2ODBiZjgzYjQ1MTBjYmM4ZTVlZjQ4&t_s=download_link&t_ts=1782669260

  Score

  10^/10

  defense_evasiondiscoverynanocorekeyloggerpersistencespywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1