Overview

overview

10

Static

static

swift!!!.exe

windows7-x64

10

swift!!!.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    swift!!!.exe
  • Size 996KB
  • Sample221016-pgldfshdhp
  • SHA256 7f4037a13857e6b8c8d67cdae301b33289d2e66f3a9e618faab005be42c47ed8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbook5pdfratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • 5pdf

Decoy

  • ImkB41yxewa+HeQyPpDm

  • cLnVt4DNZCL7QEV5KG7giA==

  • OIEUzLUFkDn8y4abGEtC4yglSTX4

  • EqHHULn+zpNozLr4ibEAuwM=

  • evmLCwphcPbQTMEOmOyOivz3oA==

  • itXoy64T3qaBgfZMZ4hP7x4=

  • 11lkKSydVQazaCfB

  • rjVa6Vuxhm7o0DaMVKRiAEG548hjbXUh

  • A5LGUb4V4HhTGw5J2kbJWt+1TcZ/lwk=

  • Z/IjCQhZrlVCQyl3LzzkkQ==

  • 6S3Gn/1WV9DAuTpo8FyBEyDvpw==

  • RZOeKrIJoj4kjlSGfuE/3ZSf

  • Roivd82k8rJ8

  • fwWrgboRZx7FLOUyPpDm

  • aOsu9kWm5IZ+Mforn+g=

  • q/+gMjuW2IJrbFCKBUzDT+Y7zBw=

  • Za7YfdYb33L3lELL

  • PX2kfQd1toOMfCutdLEAuwM=

  • qUFE/vlKjo1rXujioun6vQA=

  • xyUrsDOTXhbIrl7ejrEAuwM=

Targets

    • Target
      swift!!!.exe
    • Size 996KB
    • SHA256 7f4037a13857e6b8c8d67cdae301b33289d2e66f3a9e618faab005be42c47ed8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbook5pdfratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks