Extracted

• • Target
    csfutbolakademi.com_chrome.exe
  • Size 50KB
  • SHA256 da3f4c1b8fb1ad850f0498bb223f2e6b634e0f1bcda73bedf8a88d19efc62263
  • MD5 f937081463d066e276e645f490375694
  • SHA1 6e4476c1e7d911523a22deff347f943b4b9ee080
  • SHA512 e0279753a1ff35465ca40b810c8419cad440d0e567de798a054029f5197c3cbdf9c3b87c91d60d90f122f4cd5d864fdff204e2e5690d51edb8d8613191519ecd
  • SSDEEP 768:QdZDRtxpF0WBmCmypxLJ+Ihl1l/a/Rgr4qC1XXGblfppiKFc5xh:klBf0xlypdhlDaGr4qEXGblfLiucl
  • TLSH
    T14D33F60477F98211E1BF4ABA4DB191119B31B8939D32D79E0BD505CE1AB3B80CDA8F67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies security service

    defense_evasion

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2