Extracted

Extracted

• • Target

    8XN2B1_Payment_Receipt.vbs

  • Size

    552B

  • MD5

    7578770adaa094d49594be394effcb3b

  • SHA1

    8d919e1d10a590babbb1e88707f41b5653080cba

  • SHA256

    a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532

  • SHA512

    363d36082d2be9e50ee113e7061ae1ecbd1096ab21d71e900281d94f7bfc34a546e3e15b42a95f03542dd8ceed0c0d6ce22ed36c7afba4e6344cdeeffc03593a

  Score

  10^/10

  bitratnanocorenjrathackedevasionkeyloggerpersistencespywarestealersuricatatrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • BitRAT Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • suricata: ET MALWARE Possible NanoCore C2 60B

    suricata: ET MALWARE Possible NanoCore C2 60B

    suricata

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2