Extracted

Extracted

Extracted

• • Target

    8vm39x_Payment_Receipt.vbs

  • Size

    513B

  • MD5

    45586ab9fada3f0335af9c963a4cc5d5

  • SHA1

    5a342ed6755dc395215956143a54bcc4e42b97e7

  • SHA256

    fb8c086de0ae136dd3cff31c3be2283d0de57d1eac3383616c02ba50aa02978e

  • SHA512

    01ea352ada496a0d1426dd58f503771db1ea59f4b508157be3174174c99a74bb70288136a53b6051dc5dcd0e37c9525eec5f554e910b34cbcf3e63d42e26ff49

  Score

  10^/10

  bitratnanocorenjrathackedevasionkeyloggerpersistencespywarestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • BitRAT Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2