Extracted

• • Target
    www.exceleratecapital.com_new.exe
  • Size 26KB
  • SHA256 31089e490995d0e5bc3a8990059f99210de250397034b05d5aa31c5217fa5db0
  • MD5 b721775cfd848bcc8088b6b375f24978
  • SHA1 edc82e6cdcb78c5f07f6c077bf9bd6116e7539cf
  • SHA512 e489913d1234c707bccfa9ffab553cd3f0e6263481ba56a0861de19b876188ed4b7500423386995acbd119863bcca4ce5544cbe1f31dd910244f9a76e793a7a6
  • SSDEEP 384:x+FeeD8RwEHTvKdpPgvI+kpxCjmFj1l4+FIOUx9QTGwNf8G+H+dz9ySyW5S+W:wce4zvqPgq8cxmyID96F8z2BySs
  • TLSH
    T17EC2E64177FCC228E0BF6BB65C3257004775B89BCE16CB0D0EE9848E1E77B444AA57A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2