Extracted

• • Target
    Payment Advice Ref SCB100736792577.bat
  • Size 267KB
  • SHA256 f6557b3412ca78e87ff38632aaf24732b74da646678fd6ea5f01134bb498fd14
  • MD5 22ca964538e0d241d32f43dd21339a71
  • SHA1 554da18303b6f1effcd638c037a1a77181ea2fd8
  • SHA512 85924e1b21580b4f18f70ffd165e50e6b82e1746a7a5bb17762384df796137f39d0bb14773be9650da693e2ac5f1f3e3ac5df10c1558ac9243fd34116d521f87
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookcoreentityratrezer0spywarestealertrojan

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2