Extracted

• • Target
    Mercado_Credito_17_07_26.bat
  • Size 1KB
  • SHA256 fe60df668507b65bbc0b9da9f9f1c94def9f0f32c7335b1f78e8054252bf2187
  • MD5 218a8e57536e1b31ec426ad0d92af2f0
  • SHA1 439716bb23ae5e251614ebe984ed19d0921b4c75
  • SHA512 2e9072a338d9bac3dfbeaaa07a8a8ff1e17f4cdf60a62fa8949b50ac0e51ce75e5f4c770866800e95c1c433b2ae4d81cdb5ea570ad2f12466aa01b694aa5ba4e
  • TLSH
    T13211908A7575E298CE610EA54C33D570F44A65D7C2411C81B39FC936CB897C9FADD281
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistencestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2