Extracted

• • Target
    socolive-1.site_new.exe
  • Size 25KB
  • SHA256 d88ac12aac21a01117b27f6f738f4547117c66e62b60c8bd75241e38af1f14f4
  • MD5 6aa308751d40b1d128d5c752ca414e5e
  • SHA1 202237935f2a8929bfbdd047f6c51463958368fe
  • SHA512 ecb318495aaa22ee77dd2e6778a01192188e6bdfd3c9887e91e5f831804e717b351c2dc7ff06e285d92a6aeff69f7ed1ed3594bf864ba0576b4da95f2fadd1f2
  • SSDEEP 384:/+Rr+eNJ083tiE0HvvQRfPgwMb52No427xbYKl4+FIhUx9lTGwNx8G+H+Mz9ySRD:m0O089ePv0Pgw0Fh3myI69D78zTBySM
  • TLSH
    T1D4C2E60177FDC228E0BF1BB65D7257004774B89B8E16CA0D0ED9918E2E77B444EA5BA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2