Extracted

• • Target

    BAT6357377.exe

  • Size

    627KB

  • MD5

    ef494e2d8600338e6c4abb514a6f2fdb

  • SHA1

    8864364fb585590e5cddc1356d44ce1ba731dbff

  • SHA256

    ab178721c79dcba37cf1979de6f85c6b3531371b8492749970d91773a505949a

  • SHA512

    b8fb64d569e1066c794567641ad28052a3684358f9faf14e393406057811f0654670687a2e702e67dae6ed8cb4000c5c16a8e42af940c9de2b9d33adafd1ce1e

  • SSDEEP

    12288:j0R/Uv8Ua4u1oV2KCe/bldkNzOzmXYu5dq1TEpT:j0R8EUa41FMkzEdq1Ip

  Score

  10^/10

  formbookh209discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2