Extracted

• • Target

    DEBIT NOTE - JJ SUN 2439S - TRHU8130777 - SHHPG24177569.bat

  • Size

    621KB

  • MD5

    b631685c5ef9ee26ded25c76ab3eda27

  • SHA1

    03696b36c4838440cf8def9687117745c9edbd19

  • SHA256

    a6d2a47171f9630a8db62eb4001e196dfbad94cf40638e108cc649883d1bc069

  • SHA512

    62fe2308ad1490495ec283027e2f07c7d5179ba9a327791de0b98a5f29db4ea3c721d3866674cedcb4033153ff5515d7f5bdc17d547191519dba70cd1c483134

  • SSDEEP

    12288:tLczRLw1+27aPipUXT8eseyW2dv1WlYpXJk1jJT8CWqpqJ4uSYGExH0z:dctLw1+AaPOUXIjew1Umsj+0q2

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2