Extracted

• • Target
    SWIFT002.exe
  • Size 638KB
  • SHA256 fdd377a939cebf1d0d77f6e5ad11bc09170ed283f51b79811478d45b3dfcda10
  • MD5 2de0fb573005cb158a0356fae71c25dd
  • SHA1 089887a506669a5739751b9a38f3fa134e3f0ff9
  • SHA512 11b5a6233e9578ca571abb299bdda001d3e800463add0c2c2b7f26215bda158ac061db39891ba6b1a406e91f5dbdec5bdc3d515c9bd460569fff1cd139f50592
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookxloaderzzunloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2