Extracted

• • Target
    Payment invoice 549590.bat.exe
  • Size 621KB
  • SHA256 5ae445a991d56393e514f68e235bf8e92b116fedc8cc6d17ae358b34f6873d09
  • MD5 b03235aae7678bfe37e8294eb4aa0091
  • SHA1 abd5536d8906ec3761b2f734e1e0c77a526d241c
  • SHA512 123c4180bc74b6610eca1ab6d5b059be18848561344b2b83d1c506a901edd06ac7fae3de0f962c2a4ef2740fc1da30630120a5af8e226fec98d148901116b8a9
  • SSDEEP 12288:y04Rg68JhzCwafmOMWxjXshtMlcuKAq7X/F3wN+KPSdq7r1/QckR:B4Rg68Pdjuxj62c/Aq7/F3wwZq7a
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookp25odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2