Extracted

• • Target

    Confirming - Notice of payment_SWIFT BJ23004300IU.bat.exe

  • Size

    586KB

  • MD5

    46827077a4c07d354de20e2e85e06d4f

  • SHA1

    056f6f4f2dc98b4d184408377f91cb4296030245

  • SHA256

    d079862ef124c7736c9321485c30fa19a7c944ac81bc683d123c1aa6c50414a5

  • SHA512

    ccd3b5c9acab1024fd0b11876b0716c0839d9e308a9a854ed2b93bb6a22f06efa4826d0d5a4ba23428d12f25290d4fa5bb35992dff6b7b004ba6c1eca91b6a05

  • SSDEEP

    12288:c0nsD9cyVPu1VOsaA+0/vOamqspcedULkqnb4:vnccydu10BOsp9Zqnb4

  Score

  10^/10

  formbookmd49discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2