Extracted

Extracted

• • Target

    U2NM18C9NPayment-Receipt.vbs

  • Size

    483B

  • MD5

    f06c964ada559c2eaca171edcbcd86a2

  • SHA1

    5222e4b0d39278418a1332331a567b2e8c6ff54e

  • SHA256

    ac316c0d4300e61d9e3bdb5a8c2d0069a41973c5495f0606f913e4c311e7df46

  • SHA512

    4a38c2b08cce4857281e7fafe0348bf1520de5e8fc1a5e285f702020f0a5caf0984d4dea550b109367201aa73ed28fe1f1fd888385f0f81207a48cd5c6987c08

  Score

  10^/10

  bitratnanocorenjrathackedevasionkeyloggerpersistencespywarestealersuricatatrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • BitRAT Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2