Extracted

• • Target

    Wire Transfer Copy-006566.bat

  • Size

    620KB

  • MD5

    196e5396decbd8a8c4fbad95879b8a80

  • SHA1

    e38084937ff988d95cb1d0ecc94d1c3bff6c419a

  • SHA256

    ccbabb104efcbd684a891982f957df4f45ea42323f3e2c26c3ffd6816f0832bd

  • SHA512

    9411c95a1500ecb01b10f4ee7cb3f0135f376d8f7f2c70e69506d1685fd16aea1468d56465ae60cf6593c8717bab68229cb7d4341535abd7a3c0db9b4e84dc1c

  • SSDEEP

    12288:nVVRCY4DZ8fazulqCgPAq1FE31PfzHXefLT3kR:7RCY4d80Iq1A1HzH0y

  Score

  10^/10

  formbookm49zdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2