Extracted

• • Target

    Swift Document/Swift.com

  • Size

    650KB

  • MD5

    ef3338a3b8a2ceada139c407bef9988a

  • SHA1

    953b63712fa2d92f11dcd15df323373a80dff168

  • SHA256

    5e4f25c393d72fd8869caba599e287fedfea84da53e37da77da60dc7f52fcdf7

  • SHA512

    cf375dfc96fcba23763244a29e8a0cc8ad5a3cfb095e34c827bfb4aa7bfb3aa2d8d2a50f9f14f3bad5ece09691f47e57769a5bf3fb16fe2031afdb885b5fc92b

  • SSDEEP

    12288:kxqeeZE2ztZjw1WoF9vV64KswzGSjsZc769k:kx0ZMWyN/rw6SgK6W

  Score

  10^/10

  formbookchu20discoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2