Extracted

• • Target
    socolivett.live_new.exe
  • Size 25KB
  • SHA256 069ccab6c4d4f37bc89d3f4120c922f0fe3de4aba364862e1810ccdb6281f3dc
  • MD5 c24f964902ef32cc5c02fc329e55b85d
  • SHA1 e92fc9547f3845736ba5fd2e70f75b426c0a511b
  • SHA512 730cf7e6b48a7300d222259a46d5e24dc4447d156c273832a605e92a89bd2f5933d4be4b6038644756a41ac93359f140d50de87b1d3823f3c21a8d8357bc7a76
  • SSDEEP 384:p+Rr+eNJ083tiE0HvvQRfPgwMb52No427xbYDl4+FIWUx9QTGwNJ8G+H++z9ySRD:40O089ePv0Pgw0FhGmyIL96z8zRBySX
  • TLSH
    T1D8C2E64177FDC228E0BF1BB65D7257004774F89B8D12CA0D0ED9818E2E77B444EA57A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2