Extracted

• • Target

    swift mt 1033.exe

  • Size

    743KB

  • MD5

    df300e93be84410e629996a8050e47b2

  • SHA1

    1ace59620fa5e6b7717a04ad28620e6a61191c80

  • SHA256

    36ac663aee997b4b8da3bd498abcbdb91ca180f7afe402ce8ab166099c098cbf

  • SHA512

    435302f901c1068288bf80e5726f3f9d0cbb4bfc6a3b489c7e3260698aa0b3e1707a203d3998b99ea183a21f3a1736eaa422fee358d88eb795647d665fa7b705

  • SSDEEP

    12288:w38f2uE1zDf5n7Dm1C8T7bl9JrUKrlR+v+Yyf39fiQyHWsUuAPM5Uf8f2:w3u2uO3B4Ck59ReyfN5kWtuAa4u2

  Score

  10^/10

  formbookk49sdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2