3b19486b4e14b206ec8ab2602ec6a430f9fce7ef40247b1e1f4c6f004ee468b4 | Triage

Submit
Reports

Overview

overview

9

Static

static

7

Swift.exe

windows11-21h2-x64

9

Swift.exe

macos-10.15-amd64

4

Resubmissions

01/04/2025, 20:55 UTC

250401-zqx4qaypz4 9

28/03/2025, 18:34 UTC

250328-w7tk3s1py6 9

Sharing

General

Target

Swift.exe
Size

20.1MB
Sample

250328-w7tk3s1py6
MD5

532e28bfd55208ef66d609a48a65cf91
SHA1

5da3a7f1a437cae4109b4c052b7de697bc58a674
SHA256

3b19486b4e14b206ec8ab2602ec6a430f9fce7ef40247b1e1f4c6f004ee468b4
SHA512

10c57c4bd1c18242405bb7ac89361121b6169f3444122dbef246e4605b0f793f205a9fb36f5a8d820e9c8617bddb9df65b9590acbaada19a89ac7a064a23a0f1
SSDEEP

393216:V8JNpovBLKnLuJxQBqYuIavH5Cmq+Je5tmCTtu32syZ1k3hqdE7w:VMpWNW0mBqfvH5SZtlTtuGZgxqdcw

Score

9^/10

defense_evasion discovery execution macos themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Swift.exe

Resource

win11-20250313-en

defense_evasion discovery execution themida trojan

windows11-21h2-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

Swift.exe

Resource

macos-20241101-en

defense_evasion

macos-10.15-amd64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  Swift.exe
- Size
  
  20.1MB
- MD5
  
  532e28bfd55208ef66d609a48a65cf91
- SHA1
  
  5da3a7f1a437cae4109b4c052b7de697bc58a674
- SHA256
  
  3b19486b4e14b206ec8ab2602ec6a430f9fce7ef40247b1e1f4c6f004ee468b4
- SHA512
  
  10c57c4bd1c18242405bb7ac89361121b6169f3444122dbef246e4605b0f793f205a9fb36f5a8d820e9c8617bddb9df65b9590acbaada19a89ac7a064a23a0f1
- SSDEEP
  
  393216:V8JNpovBLKnLuJxQBqYuIavH5Cmq+Je5tmCTtu32syZ1k3hqdE7w:VMpWNW0mBqfvH5SZtlTtuGZgxqdcw
Score

9^/10

defense_evasion discovery execution themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Resource Forking

Virtualization/Sandbox Evasion

Credential Access

Discovery

Network Share Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionthemidatrojan

behavioral2

defense_evasion

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.