Extracted

• • Target
    SWIFT COPY.exe
  • Size 335KB
  • SHA256 6c45a4d4ed82e89fc389c64729ef65d08fa313ad92e0818f6c1fa96156d66f4e
  • MD5 ebabed291602498abfacc0fb8df14fd8
  • SHA1 e5af4842b739d854e771620fca42a357ccb5781b
  • SHA512 aeedb753c3a38c5d88e5be1be95455f6ba1366830f5a256875b7e0a64bb983719327bfbbf978e2e23e07506874ca59d4ba57e0d11735e6443e9d4c86e1e99b6a
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2