Extracted

• • Target

    Pedido de Cotação - RFQ 31072024_Lista comercial.bat

  • Size

    615KB

  • MD5

    1cc3edbb74f2ee6d727579c246057f95

  • SHA1

    2e7ee47afb0752c640b598f5bb7efada674af88d

  • SHA256

    3e9f3a83f830c41cfec094e86c31a8c79c032814a4f029eba014cf90b7db75ab

  • SHA512

    4fd715f9487daba8cfe32f4463cc675cf681a1377a2c1d097d74aa8bf63c54cd8f510761b4d49d6259ae315ab66670684b216d4d6217cd0a4cd5925cf3123de4

  • SSDEEP

    12288:NeFFFFFFFF6VxOpnAArP4R1PiXQF7wxqMrI3NL/P9IqeiT/ihYWZRvYZo+5oK:NeFFFFFFFF6VwaArwRA+wgMr6lP93eiF

  Score

  10^/10

  formbooksy52discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2