Extracted

• • Target
    mitomtv-https.com_new.exe
  • Size 25KB
  • SHA256 66772882bc9fdb74edef3becdb4451942f0e8ed44441c9dbf516569892f6227c
  • MD5 303a36c7e0400bacbda12de4b0d67285
  • SHA1 4df5eacc065a3ee9e906e44cfc66c894e1a5a5ee
  • SHA512 f73b5eb65f2147edbfdb20cf44f7b82eb54e1c8b98a8878d602ce52078d603c2e89719d1bfac7b2c0f87adbc762470eac0dbaea237ff0e337c9cb267b5a7eb8e
  • SSDEEP 384:Z+VOOLfpGgEHjv3ZPg/fuRQAKfNUSHNil4+FIDUx95TGwNr8G+H+3z9ySRW5xbW:I8ZDvpPg0KuSHwmyIc93x8zUBySG
  • TLSH
    T161C2F7417BFCC229E0BF5BF65C7657008775B88B8E16CB0D0ED8908E2E777444AA57A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  behavioral1behavioral2