Extracted

Extracted

Extracted

• • Target
    H2J1M7D65PAYMENTRECEIPT.vbs
  • Size 2KB
  • SHA256 89b129e7f88a0d4fd5d977b3cb427866a157ef99abccc3e41c564b5a2441dafa
  • MD5 63975e8c7e5307c832199dfdab8917f5
  • SHA1 31cb6c33badba8193cb53df994e9a1db72ac5b0e
  • SHA512 bfe2660feed753461ffe1c6f75507772acd2afcd65c59ae1c5fe041c6b06d535e77c33f6d1ded4c8eff7bc9735199fb657ab59afaa4911fcab914c81bda52a49
  • MD5 SHA1 SHA512

  Score

  10^/10

  nanocoreneshtanjrathackedevasionkeyloggerpersistencespywarestealersuricatatrojan

  • Detect Neshta Payload

  • Modifies system executable filetype association

    persistence

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    suricata

  • Blocklisted process makes network request

  • Modifies Windows Firewall

    evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2