Extracted

• • Target
    BAT6357377.exe
  • Size 627KB
  • SHA256 ab178721c79dcba37cf1979de6f85c6b3531371b8492749970d91773a505949a
  • MD5 ef494e2d8600338e6c4abb514a6f2fdb
  • SHA1 8864364fb585590e5cddc1356d44ce1ba731dbff
  • SHA512 b8fb64d569e1066c794567641ad28052a3684358f9faf14e393406057811f0654670687a2e702e67dae6ed8cb4000c5c16a8e42af940c9de2b9d33adafd1ce1e
  • SSDEEP 12288:j0R/Uv8Ua4u1oV2KCe/bldkNzOzmXYu5dq1TEpT:j0R8EUa41FMkzEdq1Ip
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookh209discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2