Overview

overview

10

Static

static

10

87857c43cf...0N.exe

windows7-x64

7

87857c43cf...0N.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

CONTRIBUTING.ps1

windows7-x64

3

CONTRIBUTING.ps1

windows10-2004-x64

3

Modules/SWMB.ps1

windows7-x64

3

Modules/SWMB.ps1

windows10-2004-x64

3

Modules/SW...on.ps1

windows7-x64

3

Modules/SW...on.ps1

windows10-2004-x64

3

Modules/SW...UI.ps1

windows7-x64

3

Modules/SW...UI.ps1

windows10-2004-x64

3

Modules/SW...cy.ps1

windows7-x64

3

Modules/SW...cy.ps1

windows10-2004-x64

3

Modules/SW...ce.ps1

windows7-x64

3

Modules/SW...ce.ps1

windows10-2004-x64

3

Modules/SW...UI.ps1

windows7-x64

3

Modules/SW...UI.ps1

windows10-2004-x64

3

Modules/SW...cy.ps1

windows7-x64

3

Modules/SW...cy.ps1

windows10-2004-x64

3

Modules/SW...ll.ps1

windows7-x64

3

Modules/SW...ll.ps1

windows10-2004-x64

3

Modules/SW...g.psm1

windows7-x64

1

Modules/SW...g.psm1

windows10-2004-x64

1

Modules/SW...t.psm1

windows7-x64

1

Modules/SW...t.psm1

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    87857c43cf615aa72fa55bcdad95c6e0N.exe

  • Size

    441KB

  • MD5

    87857c43cf615aa72fa55bcdad95c6e0

  • SHA1

    c8f9db734a4b7db157351db1ac0ed6b994190876

  • SHA256

    6972dd95a206dd9ed4bf0d977889b0a0f49bf026067f7983a9fffc1d4092b4c1

  • SHA512

    6ec272ce3059eea2dcffd681625e3a3f4250659b8ca4a82c7ec602b30eec800b203b924fa6ea66d963468d71c40f8bbdc5cfc2bff2334e51b98e89b7cf3cbc02

  • SSDEEP

    6144:7PxMXhQz6b21q+ZwhXrEkgNtSiPAPqhWkL7XWX0/OiFnS:+0q+A76APqhBrWXb0S

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://gitlab.in2p3.fr/resinfo-gt/swmb/resinfo-swmb/-/archive/master/resinfo-swmb-master.zip

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 87857c43cf615aa72fa55bcdad95c6e0N.exe
    .exe windows:4 windows x86 arch:x86

    6f9fd465750a0db68adce98869da7d3c


    Headers

    Imports

    Sections

  • $APPDATA/SWMB/Presets/CurrentUser-Logon-Test.preset
  • $APPDATA/SWMB/Presets/LocalMachine-Boot-Test.preset
  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    b844086d4b3e59aa7b4439d88bcb40cb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    decb956787d27b8d68f6baf3fdca54ed


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    c442f1649aa0670a32c622fadfcd00bd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    c3edd09206117610ac78ba82816b607c


    Headers

    Imports

    Exports

    Sections

  • CONTRIBUTING.md
    .ps1
  • FAQ.md
  • LICENSE.md
  • Modules/SWMB.psd1
  • Modules/SWMB.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Application.psm1
    .ps1
  • Modules/SWMB/CurrentUser-ExplorerUI.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Privacy.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Service.psm1
    .ps1
  • Modules/SWMB/CurrentUser-UI.psm1
    .ps1
  • Modules/SWMB/CurrentUser-UWPPrivacy.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Uninstall.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Unpinning.psm1
  • Modules/SWMB/Custom-VarDefault.psm1
  • Modules/SWMB/Custom.psm1
    .ps1
  • Modules/SWMB/Experimental.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Application.psm1
    .ps1
  • Modules/SWMB/LocalMachine-ExplorerUI.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Network.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Privacy.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Security.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Server.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Service.psm1
    .ps1
  • Modules/SWMB/LocalMachine-UI.psm1
    .ps1
  • Modules/SWMB/LocalMachine-UWPPrivacy.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Uninstall.psm1
    .ps1
  • Modules/SWMB/TemporaryBypass.psm1
    .ps1
  • Modules/SWMB/Version.psd1
  • Modules/WiSeMoUI.psm1
    .ps1
  • NEWS.md
  • Presets/CurrentUser-All.preset
  • Presets/CurrentUser-Logon-Recommanded.preset
  • Presets/CurrentUser-Logon-Test.preset
  • Presets/LocalMachine-All.preset
  • Presets/LocalMachine-Boot-Recommanded.preset
  • Presets/LocalMachine-Boot-Test.preset
  • Presets/LocalMachine-Cloud.preset
  • Presets/LocalMachine-CortanaSearch.preset
  • Presets/LocalMachine-Default.preset
  • Presets/LocalMachine-Service.preset
  • Presets/LocalMachine-Telemetry.preset
  • Presets/LocalMachine-UniversalApps.preset
  • Presets/LocalMachine-UserExperience.preset
  • Presets/Post-Install.preset
  • README.md
    .ps1
  • REFERENCES.md
  • Setup/post-install.ps1
    .ps1
  • Setup/pre-remove.ps1
    .ps1
  • Tasks/CurrentUser-Logon.ps1
  • Tasks/LocalMachine-Boot.ps1
  • Tasks/LocalMachine-Crypt-With-Bitlocker.ps1
    .ps1
  • Tasks/LocalMachine-PostInstall.ps1
  • Tasks/View-All-Software.ps1
    .ps1
  • Uninst.exe
    .exe windows:4 windows x86 arch:x86

    6f9fd465750a0db68adce98869da7d3c


    Headers

    Imports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    decb956787d27b8d68f6baf3fdca54ed


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    c3edd09206117610ac78ba82816b607c


    Headers

    Imports

    Exports

    Sections

  • dists/README.md
  • dists/uninstall-kaspersky/README.md
    .ps1
  • dists/uninstall-kaspersky/get-password-cleartext.ps1
    .ps1
  • dists/uninstall-kaspersky/set-password-encrypted.ps1
    .ps1
  • dists/uninstall-kaspersky/uninstall-kaspersky-integrated.ps1
  • logo-swmb.ico
  • swmb.ps1
    .ps1
  • wisemoui.ps1
    .ps1