Extracted

• • Target
    xoilactvf.io_nano.exe
  • Size 64KB
  • SHA256 17f26900265592be0a5fe245815ede8130c72f4bd9824497d87ca893ed550a96
  • MD5 4172adbeb046991751baf6fe77ea4abf
  • SHA1 37d67c78cd50b9ae42253e77bef39352932e1cd2
  • SHA512 4d75e8200eac1054dcfcde230d90780618b9b966c9185201474d209dc48a2d9da8fdba78a67d70b98eb65648682c16b41bcbebbe8a5ef0ba34e00a8ecafad4fc
  • SSDEEP 1536:tOO8rRWzXCDMYDPzZUF9Uto/98Opu2A2WCc3Vnwruagnb:PdSDMYDPlUF9UY98OpXA2WCc3Vwrurb
  • TLSH
    T1CC53E78477ED8621E5FE4AFE8D3195114731F8679C23D78E0A84048E1AB2784CEE8B27
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies security service

    defense_evasion

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Disables service(s)

    defense_evasionexecution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2