Extracted

• • Target

    PO11534.bat.exe

  • Size

    642KB

  • MD5

    3d680bae4987c65237ff5191316eb984

  • SHA1

    2b1030c6daba94e4c849523d417a2a02eb2d342b

  • SHA256

    ec6c0b68ad723bfd12ffe050b290318de9f50ceaac13a9f9483d42a6301ac657

  • SHA512

    f30adc17d74a5b33918361feac87c3d41059d00ae5e84e8550a7894839e5ddd45a6b0a4b2dae1af4469c17e52c13e3566babdc34e3f37d3a0e730329f6ec1a80

  • SSDEEP

    12288:KxCkhMOoltiJ76q2GRIUoeQYVHFpkYdDVlz3tVnrW+EhBv7:MCkh5oDiJVRI3kTPi+WB

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2