Extracted

• • Target

    BOQ & SPECS-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe

  • Size

    691KB

  • MD5

    8f91e7ab8e06bf58adf2509e93159a5d

  • SHA1

    2d2fea690c15c4bfe9f9ca4c0b8b8cc509d7daac

  • SHA256

    5cd64ae8366b7fa1f1dc762013e0fe8e30caa6c6aa50a0df07cf3a953de6749c

  • SHA512

    6bd3689dc70b7a033f152e21c02d5c1ce01db3cd7898d884b24762a90ff2c2c52b5b58853797601fdc4d702a2b557e2d86d098fe7084121da464d48907ef856d

  • SSDEEP

    12288:sH3wtfRzxWWgA2ymE5HhizN0PUWesw18zm+gem395mSVb2h17pcU:sHMpzxWNbymCHhizqpeDCgeU9Y

  Score

  10^/10

  formbookcd36discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2