Extracted

• • Target
    veggi.io_new.exe
  • Size 25KB
  • SHA256 088aaff551da2b2368c0251eddb90d0171311373645001782b89e7ea2835eab0
  • MD5 ff2120a40f7a1f972dcc5e4a7451be63
  • SHA1 50b61033bfe86f6d5cdde05fae6b7664f675b129
  • SHA512 c982edc91b61f5c3fe76270328fbc9ffc0c3fda65383a2d82cd81c8b289f8cf0c73fc9deea25d57f71dc920094e5617ee4db3a9eec805c4a53356a32fbe092ee
  • SSDEEP 384:o+fgx84ymu0Hxv0WVPg5chXcMZWcWl4+FI8Ux9OTGwNH8G+H+ez9yS9W5owW:B43RvZPg6Fc0WxmyIh9Ad8zVBySn
  • TLSH
    T129C2E74177FCC628E0BF5BBA5C7257004775B89B8D12CB0D0EE8849E2E777444AA5BE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistencespywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2