Extracted

• • Target
    thebl.com_new.exe
  • Size 25KB
  • SHA256 3a666204addb1f9577a203d770db6ecdfdec6411d23cb43bd60f006a3b86f016
  • MD5 52451523447494dd781a7193c4bfa0ef
  • SHA1 425a34c180e91c24b84988aee88a95c1721d09a2
  • SHA512 c3d5d333f7d732641be015915151151e142b290542b00ebd3f5476851a125290d0c917adb7bc937c0fb0611e3ebb7a5696b6ff42018a811f4dfe9d8fe92d55d9
  • SSDEEP 384:/+l+CEuskQEHzvXo6PgP4QWvErX7ztghl4+FI2Ux9cTGwNb8G+H+Wz9ySRW5OSW:mcdeTvXbPgQQLrVYmyIr9Gh8z9BySp
  • TLSH
    T164C2F84177FCC214E0BF5BB75D7657008775B8978E17CA0D0EE8848E2E777444AA4BA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2