Extracted

• • Target
    getfixd.io_new.exe
  • Size 25KB
  • SHA256 a88d14ea2c3554eb70b1aca83235bcf1dc49d2575bba1bfb37d4a3021f131099
  • MD5 5791f11cab1827a74bd208f450189c04
  • SHA1 92919564b5ff155b1c281ec88416bc2a8c8188cd
  • SHA512 2837746580d41feb64f30c5097557afd0dc1e9fdcce70f185a85ab8668b520b11a210cba0b8a6090eecbf687e6f932298adc83cba9961b853e61355d49764164
  • SSDEEP 384:t+fgx84ymu0Hxv0WVPg5RTOZBpPltTDl4+FIRUx9eTGwNW8G+H+Zz9ySpW5lXW:843RvZPg/G3myIK9wA8zmBySy
  • TLSH
    T199C2F8417BECC228E0FF5BB75C7657004774B89B8E16CA0D0ED9848E2E73B4449A97A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2