Extracted

• • Target
    xoilactvz.com_new.exe
  • Size 25KB
  • SHA256 bd8a5976a911078556dd6f4b113f828bd1a5e2cd240ae8b868f4aa2650502dbb
  • MD5 c3587af1f67db5b920d97005ac954fdc
  • SHA1 9724df0c409469090708c1a55c6921fba4884cd1
  • SHA512 e365fc80fdda4161bf8dfb0436c06454fc231a3d355000993c286e5caf7ba0fd7dd892b657ae166bdd2878fd7ab7eebf3f9fb22a7aad1ee542ca5de0d1c029d0
  • SSDEEP 384:i+9W/96MIZ+HLv4SPgHxWvd0MIwnql4+FI7Ux9oTGwNm8G+H+hz9ySxW5ndW:Dc/7rvDPgQ1i6qmyIU9CQ8zmByS8
  • TLSH
    T138C2E74177FCC629E0BF2BBA5C7257004775B89B9D16CA0D0EE8908E1E777444EA4BA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2