Extracted

• • Target
    Mercado_Credito_17_07_26.bat
  • Size 1KB
  • SHA256 46fdcf548cfdf057beab02510431b1a301f35a517b0c6d333ef3bd70a9bd17bc
  • MD5 bd94db79d9a3f4b6f063185403a18c87
  • SHA1 0c436b4728f5e79143692fe31310c03c92aa8dd5
  • SHA512 69945d61fb310359a00b07d767e2d99c89effbba249d450918fed48658a27d7bc9cb92b521ca78bdee69f6db32d22f974f9d07784f76d7247beb48d91116e423
  • TLSH
    T15E11BA8A3164E258CDB10BA54C33E570F84925C7C2411C81B3AFCA368B89BCAFADD281
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutioncredential_accessdiscoverypersistencestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2