Extracted

• • Target
    Swift Copy.exe
  • Size 335KB
  • SHA256 3f180fe3f695de063f953d0c48408aceabbca729b3faa7316926c69650a5f8a4
  • MD5 8d5bb155ec1fbeae176b38e35eafcc7f
  • SHA1 741532ba5150b1cf259ab02d3c88406a3ff25556
  • SHA512 e68d904072af535b907eb6ae515f1dc6bcec867e11b429834a2002f03669dbaa299db95c02412d122ec618c6116159a36f6b979c00dfe3dc8ced53327ecd614f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2