Extracted

• • Target
    Mercado_Credito_17_07_26.bat
  • Size 1KB
  • SHA256 d24a822344879df906b8b8ad201a3f17b142a24c18db515572dbf13d3b6ec1ae
  • MD5 6a3b573102350d8e9edc2318e4184953
  • SHA1 6f51bf9762076986498bcec25c11cf317f454ba1
  • SHA512 febe953603e088e9da5681c050b4111fc48cca6ec5cede3f53b275b53ef4192092d17b98f8d2e86deb003afb0455fc82e42dcc316120f869aa421ef46b862a13
  • TLSH
    T1C111BA8A7564A258CDA10BA50C33E530F44A25D7C2411C41B39FC63A8BC97CDFAED2A2
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistencestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2