Extracted

• • Target
    redcel.io_new.exe
  • Size 25KB
  • SHA256 45cc8a10d9e8df6462c6767f7fbeceba8fa768046e6676c9fcf65630701bb8f2
  • MD5 79bd4fef3597198407bbefd2bef07ae6
  • SHA1 f62c67d6c2d7ef294ccf4a80a9fd283e67701dc0
  • SHA512 7077958e00b3f27f5ff7a958c59f6db26b25b5cf90c1aa9a3801b8718309e905409de842cac3145c1ff7e0e3b60cc28f36f0c67c82fd3958ce2e5c5e9b3b3fe1
  • SSDEEP 384:0+l+CEuskQEHzvXo6PgP4QWvErX7ztgkl4+FIlUx9vTGwNs8G+H+tz9ySRW5xrW:9cdeTvXbPgQQLrVlmyIG99y8z2BySG
  • TLSH
    T119C2F70177FCC218E0BF5BB75D7657004775B89B8E17CA0D0EE8848E6E77B444AA4BA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2