Extracted

• • Target
    redlinepages.io_new.exe
  • Size 25KB
  • SHA256 2c21d9a5688723af851b5b4e185845470e3bbcdf21693fc3ba769d6e0716d428
  • MD5 ea266547cc5182171a36a6b769557d9e
  • SHA1 1793a41eca844ae8381286adc1611803dd89854a
  • SHA512 969e53626e6e1d3e6005937c1ac46ce1d125731a5004bcb7f7cced87d54869288b3a9615e716a08e7ecc850a2ec95b32e017cc1d155a4231f1029bdc3a0f2aa6
  • SSDEEP 384:++Rr+eNJ083tiE0HvvQRfPgwMb52No427xbYYl4+FI/Ux9QTGwN08G+H+Bz9ySRT:P0O089ePv0Pgw0Fh1myIA96K8zGBySa
  • TLSH
    T10CC2F74177FDC228E0BF5BB65D7257004774B88B8E16CA0D0ED9918E1E73B444EA57A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2