Extracted

• • Target
    Potvrda.cmd
  • Size 1.0MB
  • SHA256 909903adda36dcfc103a5260990c7ca1f47b4644672f2d94446c7e6e86f25a35
  • MD5 c9ad0db8c48595796320909adcf7a303
  • SHA1 a9a21e3819907bba8fc0661e84fe0a7e49b4905c
  • SHA512 cdb375e941627757cc78f4bb1b7360b8512c4f0f3a145203b5807f7027d4a952f129f4a6367e7cbd9e0bd3613bd573eafb17e6967beb36e1039f99cb20f05f4f
  • SSDEEP 24576:3r+gYZO1+u+KAgevoPUENFs0Y09Ea9P+Ex4yE:QRnyHp9O
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookdn03executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2