Extracted

• • Target
    amas2019.live_new.exe
  • Size 25KB
  • SHA256 e1a6a7d9a077dab846bb6b8572d346f173c71e577ff9eabd2b4bb922daaf5173
  • MD5 62f64e6402bd5f239493815a3ac2812e
  • SHA1 87d1adcc7048be3986bd08aa6e5f43dd39d437e6
  • SHA512 4fbb219eb2ad94397f0cce88a0cd89133d3fad9336e60beee46600ba8211ee5e1160fc18fe377ec7a8eea81e7d8888c910a59ae21d02a55706668c68b7643347
  • SSDEEP 384:D+9W/96MIZ+HLv4SPgHxWvd0MIwndl4+FICUx9PTGwNv8G+H+4z9ySxW56GW:qc/7rvDPgQ1i6dmyIf9dF8zDBySV
  • TLSH
    T19AC2F84177FCC629E0BF6BBA5C7257004775B89BDD12CA0D0ED8908E1E777448AA4BA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2