Extracted

• • Target
    socolivetv.fashion_new.exe
  • Size 25KB
  • SHA256 c1a92b480c9479bbd7dc61e16fece699de8d93e51cae818a5e8b87d31f6894e9
  • MD5 4344c4b57d01d4a71f3f5596f7ae087d
  • SHA1 f3537439969c78c7cac28d2c1663a0b183a89042
  • SHA512 9b36d58c7dad3be4ce55d2bbbba44af2c0efb9628ed89718b14332a8c0aa2794f25b6998100f2e3982d97c6a14dc75611d7516505c38fe59ea28ee4bf73e1b86
  • SSDEEP 384:5+PwWXr2eUHhvakTPgphdAgUHXul4+FIuUx9sTGwNP8G+H+uz9ySKW5EkW:oYlBvfPga3umyIj92F8ztBySC
  • TLSH
    T1D5C2E60177FDC228E0FF5BBA5C7257004774B89B8E17DA0D0AD9818E1E77B044AE47A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2