Extracted

Extracted

• • Target
    Swift_FCP240522532.PDF.exe
  • Size 524KB
  • SHA256 e9e09c2f8031763a0c8494d500bd28ca3adc87d5f700111255db99f8142f2933
  • MD5 3911e099bed114b7417378e2dbe079d1
  • SHA1 00fea996bbff2b686a0b3e275d536babacefc0af
  • SHA512 55630fbf32fb702185fbc3f6adee9f5775e6e91c0c1bf9e448d7506ebed15852970946d856d9dd399f0b12da3f0a97a05c6c2803a4546e8a034e8f89eeb3694b
  • SSDEEP 12288:7EELYhiWgZlgyCGYRe6v/M1Kx5pPKYcfzvw:oEskWgDDyb01I5pPKvfr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojanformbookdn03rat

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2