Extracted

• • Target
    socolivezn.tv_new.exe
  • Size 25KB
  • SHA256 b1a3c1391d1c9ddfa5a5343686dc975baca8e132b95d46ef7f3922aaa4467d32
  • MD5 ae45b849ce9c56e9384bc09e7038c81e
  • SHA1 77bdc032739231c1b4e1e3657684426b9e849ff4
  • SHA512 ad5d90f5bac5f8dd99589926fd89c44ff1e8a3ca3dd2c0ddf343391dc9a088b2907e6d800d3eb95e7278bd9b0caab85e1372d9824162908e98bf4a8a3d01723c
  • SSDEEP 384:D+9W/96MIZ+HLv4SPgHxWvd0MIwn9l4+FI6Ux90TGwNd8G+H+cz9ySxW58MW:qc/7rvDPgQ1i69myI39un8z7BySX
  • TLSH
    T155C2F74177FCC629E0BF6BBA5C7257004775B89BDD16CA0E0ED8808E1E777444AA4BA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2