Extracted

• • Target
    xoilac9.org_new.exe
  • Size 25KB
  • SHA256 de4aba2b6cb5a6d7cc7c253e96275940a3bf13c42f16985bb8c8cfbd1de9c9ea
  • MD5 08199a12e3e5697ff6e8b38533a06c30
  • SHA1 cefa215da5e2d88efc45cf0d715d92ec7cf38885
  • SHA512 fbd7c062479d40e1a79cf163e716ddda08d53216ffaa332e5b9c2d26160570e2bab40c3c59066f6250d1f7f6ac025dd095e2c32473325b51762d7c4b232b11d6
  • SSDEEP 384:I+Z6wcFsBAs0HXvgGPgzQm72N2bEOdSt4l4+FIXUx9bTGwNU8G+H+8z9ySRW5tfW:hEwFC3vPPglaI/QamyIY9Za8zTBySS
  • TLSH
    T137C2D64177EDC228E0BF6BBA5C7257004775B85B9D16DB0D0EE9808E2E777044AA4BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionnanocorekeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a new local user account

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2