Extracted

• • Target
    socolive.asia_new.exe
  • Size 25KB
  • SHA256 45f39ddc42c0c3b1033b2ad5db867fca1f20b6059fe2c76b4138024c173e8513
  • MD5 f9fad39644f402fe5c02efee24479772
  • SHA1 9e71de0b13a362d949ffb08fccd6fbe7919b2a3a
  • SHA512 3a64f7a5a32c3a0e635955d94c5ca4c3f93aa24696d465ac00df72623285ee4ebc2314fe53f15819967f84844d8ae499eb605ded21f184c171e144fcd6c4099f
  • SSDEEP 384:a+9W/96MIZ+HLv4SPgHxWvd0MIwnpl4+FICUx9cTGwNJ8G+H+Mz9ySxW5YAW:Lc/7rvDPgQ1i6pmyIf9Gz8zvBySz
  • TLSH
    T142C2F84177FCC629E0BF2BBA5C7257004775B89B9D16CA0D0ED8908E1E777444AA47A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2