General
-
Target
AccessSwift.exe
-
Size
6.9MB
-
Sample
250120-xcaedstjcy
-
MD5
1fd6361a817761721c9d8236d8bbfc17
-
SHA1
4b4c2cd08f87bf6d7e6ce4dff3558e3a715efeea
-
SHA256
2bc8b18ff3ce46e3cb2c02d8c41f9ff7dfa92d7b64e68388143aea8e8c532955
-
SHA512
d48bece89a518f268bbecccd9e3c8a2ac1e000c63b720dcbc20a4103d422a4d66cf0fe86ecde59975991c7882df1982a46f8a0737707cd6bbb817160626d719b
-
SSDEEP
98304:cRDjWM8JEE1F8L1amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRiYRJJcGhEIB:cR05eNTfm/pf+xk4dWRimrbW3jmys
Behavioral task
behavioral1
Sample
AccessSwift.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AccessSwift.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
AccessSwift.exe
-
Size
6.9MB
-
MD5
1fd6361a817761721c9d8236d8bbfc17
-
SHA1
4b4c2cd08f87bf6d7e6ce4dff3558e3a715efeea
-
SHA256
2bc8b18ff3ce46e3cb2c02d8c41f9ff7dfa92d7b64e68388143aea8e8c532955
-
SHA512
d48bece89a518f268bbecccd9e3c8a2ac1e000c63b720dcbc20a4103d422a4d66cf0fe86ecde59975991c7882df1982a46f8a0737707cd6bbb817160626d719b
-
SSDEEP
98304:cRDjWM8JEE1F8L1amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRiYRJJcGhEIB:cR05eNTfm/pf+xk4dWRimrbW3jmys
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3