Extracted

• • Target

    MT103-SWIFTCOPY.765454544503.exe

  • Size

    645KB

  • MD5

    bacaf023d27109a446220e48b7a1c60e

  • SHA1

    ddaec29b4f7dc71f6826aebd845e81c30dd09146

  • SHA256

    1ac77b641f98af7d2d5f052af2721c8154b8c922be31ea7914ea76bd8c6d17c1

  • SHA512

    b154ba5afb5b02fa2a7beb0d64cc519315e4c227b6c87b4c7ae38c526285215e5cc03b685d72354eb1da7d01d987933adcebcce04710848a6f9aa3667690c51b

  • SSDEEP

    12288:ycvIGc21SUSSRsyVjLu77HUd4DNFP5V4mHlcOH97OEWzm/WejH7xWsXWHWY6jRGc:fx4o2yVjC77m4DNB5V4mHlcW9yEzvX1f

  Score

  10^/10

  formbookm49zdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2