Extracted

• • Target
    Mercado_Credito_17_07_26.bat
  • Size 1KB
  • SHA256 8e2a066d4294e974a802589a25fc97d5e58d796dad14c3a7d294b25aa75a88ff
  • MD5 d74f465698a844b0d1c99f4d6c80f44a
  • SHA1 20093c4944457a267d1a6aa989e00d532fc852f8
  • SHA512 a070d08fbc68181b3bdaa0f1c325060a227a0a9dcbb9e0507de571ee088cdd9081d665deca0c88d92a4c92fc23cf4487bbfde30aef74970f221edf7ff7a9178c
  • TLSH
    T14211BA8A7578E258CDA10AA14C33E470F44A64C7C2411C41B3AFC53A8FCA7C9F6ED291
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistencestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Drops startup file

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2