Extracted

• • Target

    Payment invoice 549590.bat

  • Size

    621KB

  • MD5

    b03235aae7678bfe37e8294eb4aa0091

  • SHA1

    abd5536d8906ec3761b2f734e1e0c77a526d241c

  • SHA256

    5ae445a991d56393e514f68e235bf8e92b116fedc8cc6d17ae358b34f6873d09

  • SHA512

    123c4180bc74b6610eca1ab6d5b059be18848561344b2b83d1c506a901edd06ac7fae3de0f962c2a4ef2740fc1da30630120a5af8e226fec98d148901116b8a9

  • SSDEEP

    12288:y04Rg68JhzCwafmOMWxjXshtMlcuKAq7X/F3wN+KPSdq7r1/QckR:B4Rg68Pdjuxj62c/Aq7/F3wwZq7a

  Score

  10^/10

  formbookp25odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2