Extracted

• • Target

    new order 32724.bat.exe

  • Size

    697KB

  • MD5

    d21eb7f591f7026977a946756afc5f0c

  • SHA1

    50b8eb9bd2c5178ecff93794529bd33130d61db2

  • SHA256

    2847c9264726b6c4abbcede6bfc40c2386e93e81a8cd968c19e5493e08851f1a

  • SHA512

    80e8c1dbf23d678e7d846173674a884ebef12f627655f8b3a6ca13f8d2d1e339883d0fd2f115078ac9b76d8caeec7c3c76b7e34ef58cbc61c6afe3f421682765

  • SSDEEP

    12288:VsM2zPHKBsXeVZ79OLkj4xXVaOkwJp8fZ6MpzKX0Z/joI6MhH9CA0II1RveBYT:VsM2z1XQZxbjKFWGKh6kzKXSLoInhH9W

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2