Extracted

• • Target

    BOQ and SPECS-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe

  • Size

    646KB

  • MD5

    1503a63d6e67f948cc10e39fbea6b515

  • SHA1

    81cb8b32c91ff91887feef05e745c9012b91cc7d

  • SHA256

    2a8b2b69971d0be12c21d4117e3068c8c69b10cdaccec97225fa318eb2040cfb

  • SHA512

    8fa09c47912f02e3e6d920901fffde33553c4719bd9a81a20c9fbf0fe81320821fea527ac8e365c24af0f04967a2d53bcbd33e96c45e3d4ff8b4d8478bb4f9dc

  • SSDEEP

    12288:PvaDPw1Qk89Tmy5g835+pXpAHSWXeU6YJ3NUwbEH39XAbOoGSobB:PCLw9gTFe835EXWHS4ePYJ3Oqc39QgS

  Score

  10^/10

  formbookcd36discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2