Extracted

• • Target
    Mercado_Credito_17_07_26.bat
  • Size 1KB
  • SHA256 78069bb7fc82166f54bb2aeb293760c9dd93e65e7b15a5e74a1eb4b54540c670
  • MD5 6e2153d394794ecfa9528b174be87d42
  • SHA1 6e472caa78f3d786c9498f79cf510426d97e6ce5
  • SHA512 6c585833acb72e1e6fe5c7083854352664fe0ee76ad72b022678280e6d3a122a7de009780f7090c46a1584564123eb2e53b920e45f7a8fcf2c3666e49baf0477
  • TLSH
    T10A11DC8A7674E158CDA10AA50C33E830F44A25D7C2411C81B39FC67ACBC97C9FAEC281
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistencestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2