Extracted

• • Target
    blanktexts.io_new.exe
  • Size 25KB
  • SHA256 e7fecf5a0b4cfe11f73d0c875766828422649b2124dbb5d12f12d4218be5cb63
  • MD5 4d2efb0acb3cb9aac560e4047d769b75
  • SHA1 a76d25f8446282464f0a2e80fb86e25083149c53
  • SHA512 95ecb8f79067b8ec700963a93261955f49f18db0bdec40175eb893ed605922f9821b036f8ae7ebaa1e7427cf18eefba00c6029c2e34ab2bc571e214b56abdb14
  • SSDEEP 384:b+9W/96MIZ+HLv4SPgHxWvd0MIwnTl4+FIIUx9MTGwN38G+H+Ez9ySxW5SOW:yc/7rvDPgQ1i6TmyIF9WN8zTBySN
  • TLSH
    T104C2F74177FCC629E0BF6BBA5C7257004775B89BDD12CA0E0ED8808E1E777444AA4BA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2