Extracted

• • Target
    metaverse-mall.io_new.exe
  • Size 25KB
  • SHA256 01f770ddef80c3fd2377431f20d76bf4b9201585d281efd79237efdea10be39a
  • MD5 e0217c64ace670b3792039dcb789fdf0
  • SHA1 4f01c603b7de7069cf4aa083f4856e56e0c25219
  • SHA512 4c57820537e905fdd969d2184f1a6360d9809beb465e6cbbfab02bc9d45b9669f3da8bb27606ec0e267283499e41a1455bbdc84890ff36d3d04526f26a634463
  • SSDEEP 384:f+VOOLfpGgEHjv3ZPg/fuRQAKfNUSHNWl4+FIbUx9pTGwNh8G+H+Xz9ySRW5bJW:G8ZDvpPg0KuSH4myI09Hb8zkBySA
  • TLSH
    T1CAC2F7417BFCC228E0FF5BB65C7657004775B88B8E16DB0D0ED8808E2E777444AA57A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2