Extracted

• • Target
    2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry
  • Size 50KB
  • SHA256 29e0e772f87ae0b2a2353eaf293fed76785ab118731096187a788ac49a34e111
  • MD5 90dae9bb755c04a852cb16900f40d0fe
  • SHA1 44e0f2c2cc4554ec14bd907f2c3cadc2a4e6412c
  • SHA512 83f8f22cd3c5d1f24734d96790d6fab1cd8312d2f8097c3670b626bde96c608557ec855e097caa25986c118b1e7a6321d44bad3f9b39085be4192e9a9671cbf6
  • SSDEEP 768:MdqB17JPp0trIctHdwM5/4/RgL4wC1XXGblfppNKFc5xa:AqzRp0TSM54GL4wEXGblfLNucG
  • TLSH
    T1BA33F84477F94211F1BF8ABA4DB185119B31B8A3AC22D79D0BD5058E1AB3780CDA8F77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies security service

    defense_evasion

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects command variations typically used by ransomware

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2