Extracted

Extracted

• • Target

    251642322342_Payment_Invoice_Receipt.vbs

  • Size

    557B

  • MD5

    c5dcc6be7d966c4ce26477c647b58cef

  • SHA1

    0674d3ee153e79b551fef19ed9b612691ae5019e

  • SHA256

    0fb07baa1484eae8ec91c5c43720802ea9e5178afd37e8960544ffb210fdc1fe

  • SHA512

    6d94681f4ef4eac9da11b6422bb7716e577e207d9601c4e0b466ba8c47f6c152be7f9a0ddb06a049c7227faa77c5d35263e3169319798b3a24303d1b58791a32

  Score

  10^/10

  bitratnanocorenjrathackedevasionkeyloggerpersistencespywarestealersuricatatrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • BitRAT Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2