Overview

overview

10

Static

static

1672020Swi...76.exe

windows7_x64

10

1672020Swi...76.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1672020Swift Copy.Scan8976.exe

  • Size

    443KB

  • Sample

    200716-f1xaxaytq6

  • MD5

    041f2ac19f452b2d61a76b5d83c29297

  • SHA1

    acac069d10ae5eeb06b89c158fcaca19e8932cbb

  • SHA256

    0c3d2c9f3d8e38323436d7f47852059f7b0cfc19fa53c86196b5376b8ebe5aff

  • SHA512

    0cf2e313eb237eee5951776c6634d9173dd91867ece690691ca9e0b0c2caea49e1b3e97e92be6ce540fc5df445ca4fd8e75de073823175196f45336ccf852a6e

Score
10/10
formbookevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      1672020Swift Copy.Scan8976.exe

    • Size

      443KB

    • MD5

      041f2ac19f452b2d61a76b5d83c29297

    • SHA1

      acac069d10ae5eeb06b89c158fcaca19e8932cbb

    • SHA256

      0c3d2c9f3d8e38323436d7f47852059f7b0cfc19fa53c86196b5376b8ebe5aff

    • SHA512

      0cf2e313eb237eee5951776c6634d9173dd91867ece690691ca9e0b0c2caea49e1b3e97e92be6ce540fc5df445ca4fd8e75de073823175196f45336ccf852a6e

    Score
    10/10
    spywareevasiontrojanstealerformbookpersistence

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks