Overview

overview

8

Static

static

1

Swapper-v2.exe

windows7-x64

7

Swapper-v2.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Swapper-v2.exe

  • Size

    53.2MB

  • Sample

    240526-arzlhaga31

  • MD5

    57038ddd0431081287886edc4ce212f7

  • SHA1

    7c07c177671527d5527ba4e0d640d3767b43a01f

  • SHA256

    4a95ec6637a706b8a841dc7a1c0a7d4779e4526036fde2523c96a27056df7aac

  • SHA512

    e3b9fbf86d1061d25368ff852c2292844c9e17ebfcd6418d33cefe7598b2ab7d975e7fb251d8282cc609008ed5daae27c940104fabdafb8f2928763d4ba4b124

  • SSDEEP

    1572864:INQOrHnqf3Gd6xdnj+YV5szPE7DBzqrGN4+14:IN7jnyo6VV7BX94

Score
8/10
executionspywarestealerupx

Malware Config

Targets

    • Target

      Swapper-v2.exe

    • Size

      53.2MB

    • MD5

      57038ddd0431081287886edc4ce212f7

    • SHA1

      7c07c177671527d5527ba4e0d640d3767b43a01f

    • SHA256

      4a95ec6637a706b8a841dc7a1c0a7d4779e4526036fde2523c96a27056df7aac

    • SHA512

      e3b9fbf86d1061d25368ff852c2292844c9e17ebfcd6418d33cefe7598b2ab7d975e7fb251d8282cc609008ed5daae27c940104fabdafb8f2928763d4ba4b124

    • SSDEEP

      1572864:INQOrHnqf3Gd6xdnj+YV5szPE7DBzqrGN4+14:IN7jnyo6VV7BX94

    Score
    8/10
    upxexecutionspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks