Extracted

• • Target

    SWIFT COPY.bin

  • Size

    491KB

  • MD5

    1e83fcc22cccdab1b97887b371f4b8d4

  • SHA1

    1f2ae9417601ffea6c57643a7b56e78b50c8cb2d

  • SHA256

    ba2bf5801650d3b1efe26350bdca102f606dc7622ad4908c414789ef5c0f24b3

  • SHA512

    f5b2fa7f380d3deabc4fe346704f8689ba8b64962080aee843c346c44b98a059db743aacb301725b22c6a7dcc34c3f5810baadaed7e6e880e8bfaa7ac1fcb29d

  • SSDEEP

    6144:a8mQxbxKRcW/+sbJT4nwWQjqsV0KdYetrjstIoT5GWeuWiKASr:a8mqbx1C+6inwWQjLr2moToWaiW

  Score

  10^/10

  formbookrhkdefense_evasiondiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2