Extracted

• • Target
    traditionalnativegames.org_new.exe
  • Size 26KB
  • SHA256 adfebf84e95c2c9cc6247582f724fea5e691accc05c7cceb68bcd4ac3a954b9a
  • MD5 fee240175cde8a2aecce19f144264a36
  • SHA1 84d94d636a1f6071d63043b232f29880e1c84787
  • SHA512 c7f3120963ecaaf540e8ad611c2974a387c734c22c40add4798eda8a0584916b7d387001903a5e9b4483e25d5381e58906451a7c012589f58f2402e30a868ef4
  • SSDEEP 384:b+/AF1CUmO0HRvGjPgZtRY2wd978bl4+FIFUx9TTGwNf88G+H+5z9ySKW54606W:y4NAxvAPgNccmyIm9Bt88zyBySS60
  • TLSH
    T142C2E60277FCC229E0BF5BB65C7656008775B89B9E16CA0D0ED9848E1E777044AA4BA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2