Extracted

• • Target

    Request For PO-230102.bat.exe

  • Size

    656KB

  • MD5

    4efaeafe642c9238304aa562c1477a26

  • SHA1

    a646d9cd8aed904f5ad3ca1c7d8d03ac51be9e3d

  • SHA256

    0309aa8889daca83b4cf97ab99bc9921bb549c9187736a69c76185dfe68cd325

  • SHA512

    42c493ffc6ab03eed0d4f330bc7a544f07039816dcac30bdc1376aff0039f8845a149814b0500e7e31d07e0b4d35177a30c3fd87be171101155089e1ca665e93

  • SSDEEP

    12288:Ccir1S2IoOAc6/5rZGmy4FaMZno/BzZCvrTETrBPOK5c/UBgrmpExJIDpqY3z4FK:QaM9opsIrBc/UubIDP3XiFCQeBg0

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2