Extracted

• • Target

    DUE INVOICES.bat.exe

  • Size

    580KB

  • MD5

    b6ace82ca0cb9b68828eb46e51739e90

  • SHA1

    31021eee20bc7be003b29968cdfde3b2a2aec56c

  • SHA256

    b90d30fabfd911bdf2b7d785dee57ffd346019b889601d1411df2872d7d020d5

  • SHA512

    291ae5b8506282245b0a38976b33d080b692ee26fe3b093cc8903667e9b3a26de6032191c689585f6bf22f7856f45cd061a09877597569cec7d0a720e50cc9f7

  • SSDEEP

    12288:Co9QlwdedsgcQukU7VzTBlUh96ny0UNxYyhzvvkxr/UgVJVicty+Vo3X:ComaTgvukU7hdZkbphzXkxDt/VicU+

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2