Extracted

• • Target

    Swift Copy.bin

  • Size

    766KB

  • MD5

    8f5b567178dc84b182b9bef20d1ba3fd

  • SHA1

    c9e63301ec2c68f8d1a087678d6947eb0f94ff71

  • SHA256

    421f027f55c2899348146d6ef602fb6aaa2376c2479406a720f21f5af672d4ae

  • SHA512

    2295886a0d77655ed8c897668a7d148003a53a32885277e92fd4261b90f2465b358f1f150335c8a70ac5fc2ec5f8a5fc0a8c5e6b1324eab2f94a44dfff06c0cb

  • SSDEEP

    12288:lCMKhM39TXsTAiN81mLdCc6VbSogpA7beNEyDBcmpb7I1i5pSTTXnVluolN3l1:oMaci4OARRgeHeHBZ98i5CVlugN3

  Score

  10^/10

  formbookct27discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1