Extracted

Extracted

• • Target

    Swift_FCP240522532.PDF.exe

  • Size

    524KB

  • MD5

    3911e099bed114b7417378e2dbe079d1

  • SHA1

    00fea996bbff2b686a0b3e275d536babacefc0af

  • SHA256

    e9e09c2f8031763a0c8494d500bd28ca3adc87d5f700111255db99f8142f2933

  • SHA512

    55630fbf32fb702185fbc3f6adee9f5775e6e91c0c1bf9e448d7506ebed15852970946d856d9dd399f0b12da3f0a97a05c6c2803a4546e8a034e8f89eeb3694b

  • SSDEEP

    12288:7EELYhiWgZlgyCGYRe6v/M1Kx5pPKYcfzvw:oEskWgDDyb01I5pPKvfr

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojanformbookdn03rat

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2