Overview

overview

10

Static

static

10

swift-boot...er.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    swift-bootstrapper.exe

  • Size

    31.2MB

  • Sample

    250112-cyv8rssjbz

  • MD5

    5198f5e5f86cf3bab33474d9f17a5918

  • SHA1

    b2d24f27084f09e61d4e6b4a967703347e738977

  • SHA256

    f04d02081e7bce511bed198e97f2aa2dbd8e88d0a1507b8306dbfbe720e5deac

  • SHA512

    2925db0f60b6b550c27b32c0698b5779b425cc400618dccb8a40ebe31f0d6cc01b342f8e8dc44d11f9b6257f7708d3de3303997682e2b2a381857aae53b23bca

  • SSDEEP

    786432:GG6VYW88/LXm1NddbOzcY876Ia8vK1ynoblmU57MDIs:GtVYWNDXmddCE78rcU57R

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      swift-bootstrapper.exe

    • Size

      31.2MB

    • MD5

      5198f5e5f86cf3bab33474d9f17a5918

    • SHA1

      b2d24f27084f09e61d4e6b4a967703347e738977

    • SHA256

      f04d02081e7bce511bed198e97f2aa2dbd8e88d0a1507b8306dbfbe720e5deac

    • SHA512

      2925db0f60b6b550c27b32c0698b5779b425cc400618dccb8a40ebe31f0d6cc01b342f8e8dc44d11f9b6257f7708d3de3303997682e2b2a381857aae53b23bca

    • SSDEEP

      786432:GG6VYW88/LXm1NddbOzcY876Ia8vK1ynoblmU57MDIs:GtVYWNDXmddCE78rcU57R

    Score
    9/10
    evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks