Overview

overview

10

Static

static

10

95917a639f...0N.exe

windows7-x64

7

95917a639f...0N.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

CONTRIBUTING.ps1

windows7-x64

3

CONTRIBUTING.ps1

windows10-2004-x64

3

Modules/SWMB.ps1

windows7-x64

3

Modules/SWMB.ps1

windows10-2004-x64

3

Modules/SW...on.ps1

windows7-x64

3

Modules/SW...on.ps1

windows10-2004-x64

3

Modules/SW...UI.ps1

windows7-x64

3

Modules/SW...UI.ps1

windows10-2004-x64

3

Modules/SW...cy.ps1

windows7-x64

3

Modules/SW...cy.ps1

windows10-2004-x64

3

Modules/SW...ce.ps1

windows7-x64

3

Modules/SW...ce.ps1

windows10-2004-x64

3

Modules/SW...UI.ps1

windows7-x64

3

Modules/SW...UI.ps1

windows10-2004-x64

3

Modules/SW...cy.ps1

windows7-x64

3

Modules/SW...cy.ps1

windows10-2004-x64

3

Modules/SW...ll.ps1

windows7-x64

3

Modules/SW...ll.ps1

windows10-2004-x64

3

Modules/SW...g.psm1

windows7-x64

1

Modules/SW...g.psm1

windows10-2004-x64

1

Modules/SW...t.psm1

windows7-x64

1

Modules/SW...t.psm1

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    95917a639fac89117400800ce06d78e0N.exe

  • Size

    441KB

  • MD5

    95917a639fac89117400800ce06d78e0

  • SHA1

    b4bab291b8a2f50f4abadddef0db786085e8de38

  • SHA256

    b71a373012336595f54c5a98236be404fc897dc592075e251906c9aa5e1eb791

  • SHA512

    10dffa3aa33c0708bcb7a10d4f768d67a13827a2d8bd32378da963fef941062321f3b3a1bbbd11ff33028db976074368e56dda5887d6babd7109df4c48337c12

  • SSDEEP

    6144:szPl+4HLgI6whQTryb21xiRWD036rEkgl9PqhzpfqfUdbxZSh:s4EzRkx6WuK29Pqhxj2h

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://gitlab.in2p3.fr/resinfo-gt/swmb/resinfo-swmb/-/archive/master/resinfo-swmb-master.zip

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 95917a639fac89117400800ce06d78e0N.exe
    .exe windows:4 windows x86 arch:x86

    96ab939b3b55d317ed1968d099ccc72c


    Headers

    Imports

    Sections

  • $APPDATA/SWMB/Presets/CurrentUser-Logon-Test.preset
  • $APPDATA/SWMB/Presets/LocalMachine-Boot-Test.preset
  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    b844086d4b3e59aa7b4439d88bcb40cb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    decb956787d27b8d68f6baf3fdca54ed


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    c442f1649aa0670a32c622fadfcd00bd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    c3edd09206117610ac78ba82816b607c


    Headers

    Imports

    Exports

    Sections

  • CONTRIBUTING.md
    .ps1
  • FAQ.md
  • LICENSE.md
  • Modules/SWMB.psd1
  • Modules/SWMB.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Application.psm1
    .ps1
  • Modules/SWMB/CurrentUser-ExplorerUI.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Privacy.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Service.psm1
    .ps1
  • Modules/SWMB/CurrentUser-UI.psm1
    .ps1
  • Modules/SWMB/CurrentUser-UWPPrivacy.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Uninstall.psm1
    .ps1
  • Modules/SWMB/CurrentUser-Unpinning.psm1
  • Modules/SWMB/Custom-VarDefault.psm1
  • Modules/SWMB/Custom.psm1
    .ps1
  • Modules/SWMB/Experimental.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Application.psm1
    .ps1
  • Modules/SWMB/LocalMachine-ExplorerUI.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Network.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Privacy.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Security.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Server.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Service.psm1
    .ps1
  • Modules/SWMB/LocalMachine-UI.psm1
    .ps1
  • Modules/SWMB/LocalMachine-UWPPrivacy.psm1
    .ps1
  • Modules/SWMB/LocalMachine-Uninstall.psm1
    .ps1
  • Modules/SWMB/TemporaryBypass.psm1
    .ps1
  • Modules/SWMB/Version.psd1
  • Modules/WiSeMoUI.psm1
    .ps1
  • NEWS.md
  • Presets/CurrentUser-All.preset
  • Presets/CurrentUser-Logon-Recommanded.preset
  • Presets/CurrentUser-Logon-Test.preset
  • Presets/LocalMachine-All.preset
  • Presets/LocalMachine-Boot-Recommanded.preset
  • Presets/LocalMachine-Boot-Test.preset
  • Presets/LocalMachine-Cloud.preset
  • Presets/LocalMachine-CortanaSearch.preset
  • Presets/LocalMachine-Default.preset
  • Presets/LocalMachine-Service.preset
  • Presets/LocalMachine-Telemetry.preset
  • Presets/LocalMachine-UniversalApps.preset
  • Presets/LocalMachine-UserExperience.preset
  • Presets/Post-Install.preset
  • README.md
    .ps1
  • REFERENCES.md
  • Setup/post-install.ps1
    .ps1
  • Setup/pre-remove.ps1
    .ps1
  • Tasks/CurrentUser-Logon.ps1
  • Tasks/LocalMachine-Boot.ps1
  • Tasks/LocalMachine-Crypt-With-Bitlocker.ps1
    .ps1
  • Tasks/LocalMachine-PostInstall.ps1
  • Tasks/View-All-Software.ps1
    .ps1
  • Uninst.exe
    .exe windows:4 windows x86 arch:x86

    96ab939b3b55d317ed1968d099ccc72c


    Headers

    Imports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    decb956787d27b8d68f6baf3fdca54ed


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    c3edd09206117610ac78ba82816b607c


    Headers

    Imports

    Exports

    Sections

  • dists/README.md
  • dists/uninstall-kaspersky/README.md
    .ps1
  • dists/uninstall-kaspersky/get-password-cleartext.ps1
    .ps1
  • dists/uninstall-kaspersky/set-password-encrypted.ps1
    .ps1
  • dists/uninstall-kaspersky/uninstall-kaspersky-integrated.ps1
  • logo-swmb.ico
  • swmb.ps1
    .ps1
  • wisemoui.ps1
    .ps1