1001f33b8ade23abddcccf1b4981639d7b410ce5ea3f5e8dbaf0c51f900bcd09 | Triage

Sharing

General

Target

Sway.zip
Size

15.5MB
Sample

210805-4lzk43ankx
MD5

d23b96d98356ecfce3b3f0b998d5b8c1
SHA1

7fbb7b5d127253e00f0108b5328bba509c534ec9
SHA256

1001f33b8ade23abddcccf1b4981639d7b410ce5ea3f5e8dbaf0c51f900bcd09
SHA512

2e719623ecaca1260375942a4f46f1fa7fa9c02efe5c1cb2bbc2f8cb1895052130f4a1e379a18340d4a6448bcf4aa3e0ad2e67be5e364763b2d0f52d9e91b60d

Score

7^/10

pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  Sway/Sway beta.exe
- Size
  
  15.8MB
- MD5
  
  31706ce374fb112fb86f48ffb158e37c
- SHA1
  
  c6153e9933bcc542cb5aab6f946f06d4bb848503
- SHA256
  
  c410d1971428f0e4492743ebf343d7be627887e6a0ff348d74a92e97cdb72d60
- SHA512
  
  35600bbb9c655a1fe39eaf612589e01b964d9aaebf097b1c3c2e3e57cd0c7014a612a591440c1eb93153740e033a74796c578da67f8f4f47c987b473b17b086c
Score

7^/10

spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

behavioral2