Extracted

• • Target
    socolivetvttbdd.tv_new.exe
  • Size 25KB
  • SHA256 4cc6671daecb69e9644aea9caf1cccd774c021342ff640658f7f434237d732d2
  • MD5 2bdbbea5797de3845f774cc54f73a765
  • SHA1 bf4ded2580b8711f7891e015d9d573a529a04814
  • SHA512 4d30f21e2ee24cb5f9ff113ba052d69fbcc639071c726925145e0a8e315faf11c8b3f5e2822c955559212438e38369966f21825cae699ae317bdf35d332d417e
  • SSDEEP 384:a+PwWXr2eUHhvakTPgphdAgUHXKl4+FIKUx9CyTGwNj8G+H+Ez9ySKW5owW:LYlBvfPga3KmyIn9C0Z8zfBySG
  • TLSH
    T1C9C2E54177FDC229E0BF5BBA6C7247004774B89B8E17DA0D0AD9858E1E77B044AE47A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2