Extracted

• • Target
    Mercado_Credito_17_07_26.bat
  • Size 1KB
  • SHA256 b3a1f5b32dce90efeb46a7dd871fda2bbbf48433b8f5c8deb79177af7b6b596f
  • MD5 a43a6ca481488bffe782172197232cf7
  • SHA1 d3abe9eedac44e33064c82cc5030a37e342f87a6
  • SHA512 246c1f5fa6cebf1817244b28f763932c621c3d540f03fbb950da553470bd593c7c1c513f1718317265149e4c96f540034d2ca20b672413b1204b3fb01e0e5419
  • TLSH
    T128117D8A7575E158CDA10B954C32E570F44965C7C2411C41B79FC53A8B897C9FADC282
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistencestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2