Extracted

Extracted

• • Target

    746390_Invoice_Payment_Copy.vbs

  • Size

    555B

  • MD5

    bebd941b4409078ae28ca82a57a01267

  • SHA1

    f52c249b1b844d30267d32bbde4e54eda2bcf892

  • SHA256

    926d056638d111d3d7f7605ba6e584a71e1c0d36fb7f9e78762ccc2669b30ad9

  • SHA512

    d65124a31d6c53e55810af2877bbcb6bfe5d34578d32709eeb167677f6b43967244fba5b49c59bd80d602450d772bd75c6ab13e2d882a0e0c52935b0c0721736

  Score

  10^/10

  bitratnanocorenjrathackedevasionkeyloggerpersistencespywarestealersuricatatrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • BitRAT Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2