Backswap malware analysis

Backswap is a compact banking trojan (a TinBa variant) that targets primarily Polish banks and some cryptocurrency wallets by injecting JavaScript WebInjects, swapping clipboard account numbers, and exfiltrating credentials. The report analyzes its position-independent code, custom Windows API resolution (hashed function names), payload storage/xor in the PE .rsrc section, novel browser injection techniques (clipboard+developer console or simulated typing), event-hooking to capture credentials via window titles, and C2 behaviors; YARA rules, hashes and IoCs are referenced for detection.