Extracted

Extracted

Extracted

• • Target

    H2M18SDPayment-Receipt.vbs

  • Size

    677B

  • MD5

    fcda4cc1ab0d4176dffbe5e90c7daf9e

  • SHA1

    ab26e9c1e1fef3457d6bdb4400dc5eb88470852c

  • SHA256

    63839b989707f31e4faa91996b54b622741e20b87d064d99b93978b554a92b02

  • SHA512

    a4e974caddba4b7fd2bc87d7f49ce349ec31f37964d47eb19fd5cf0d67b84eb90111c4ea88336bbcc37c132a86d37b56717c85ce62a9c53da929f5f4118e90ca

  Score

  10^/10

  bitratnanocorenjrathackedevasionkeyloggerpersistencespywarestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • BitRAT Payload

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2