General

  • Target

    21052024152921052024Swift2024052130819616.gz

  • Size

    6KB

  • Sample

    240522-xr6q5sdb63

  • MD5

    e6c11c2fe4d3b9d2469e1c502a142d8b

  • SHA1

    985dcc6408bbec0b7ee5ac4752f6014adf81016f

  • SHA256

    337aa6bceb4103aa9327b569ba6809401221948a6c6386eb0ca20ffc47dbfcbb

  • SHA512

    ba473024a79fe65303ebc0be4840da5c54857009a37550cf77ab6c98dc4d622e23149a44e26839649b11c4321f605fb7b2430405e757b0e36cf39a64610aedc8

  • SSDEEP

    192:yvlY+rKhGPnNrVCDTobBsUPQKt8IlRPtV:ym+mhGPtwTUBHblPtV

Malware Config

Targets

    • Target

      Swift 2024052130819616.vbs

    • Size

      13KB

    • MD5

      693d91041a54a578ada0c38a77634ee9

    • SHA1

      13e0a6c85203356af7d11ff4a0e74a6b9637f466

    • SHA256

      bb8d35012cdd6408e23b9983549095e98a88c1ccf99fc447cb92bf9d6de71b91

    • SHA512

      110e25ec6a8f8cb52a3d8a21e01ae9e2b308276111a70cd2afd64e187b41fbbedf9365170bacd971b26ee17a62df4b2174dd2580bcdb18ed768a06d01d860ccb

    • SSDEEP

      192:lLZMMji78HauxUn+OKEtfuJkEF3UxO8OY7DIsRsTYEtoTP5CfQ6x7PwYVRWFo2Uj:DV8wtkyRi/aVvdb2ze

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks