Extracted

• • Target
    alayatea.co_new.exe
  • Size 25KB
  • SHA256 59dbc7e8f33c77d370d2e4fda7557070788ddc6496a22102d4f2081e0f5a2d12
  • MD5 1e29f33ee86a7b71a5a5e6c151beabb5
  • SHA1 b32068126b97cfae537b9d7ca31063c49177318e
  • SHA512 fc5489a413e16e0ac7a6d37f9ed34f57214a95ac33c5524097d6c7bf5242179783038b934cf8af8991e55d7fca087f10c4b77800f5a928721ad848b1b9cc02b3
  • SSDEEP 384:0+Z6wcFsBAs0HXvgGPgzQm72N2bEOdStxl4+FIQUx9GTGwNR8G+H+iz9ySRW58MW:9EwFC3vPPglaI/QvmyIt9Ir8zhByS3
  • TLSH
    T1BEC2E74177EDC228E0BF6BBA5C7257004775B85B9D16DB0D0EE9808E2E777044AA4BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2