General
- Target Swax Loader.exe
- Size 66.3MB
- Sample260807-rpb6vsfm3x
- SHA256 cb027dde376be92a900ecd23bda662eface1dc569b4084fc305694ddf1f54e1d
Malware Config
Targets
-
- Target Swax Loader.exe
- Size 66.3MB
- SHA256 cb027dde376be92a900ecd23bda662eface1dc569b4084fc305694ddf1f54e1d
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/app-64.7z
- Size 65.8MB
- SHA256 f851989dc49eab58a73a1864cb7d2b1e9ee2e1ba43997ba950e2cb7a1bd1b8d4
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
Score1/10 -
- Target chrome_100_percent.pak
- Size 132KB
- SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
Score3/10 -
- Target chrome_200_percent.pak
- Size 190KB
- SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
Score3/10 -
- Target icudtl.dat
- Size 10.2MB
- SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/af.pak
- Size 447KB
- SHA256 6981249837ad767fc030edc8838878a5e493fb08cc49982cffaed16cfbeb564d
Score3/10 -
- Target locales/am.pak
- Size 727KB
- SHA256 12e9e1bec1c46e5ea706157726e17a4429acf288a5754fa183bd9b4cf7d3853b
Score3/10 -
- Target locales/ar.pak
- Size 794KB
- SHA256 3ca47b9c436723f837a53b2904b51efdf13ab6cad2f3ef4fe48a1115847eccbf
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/bg.pak
- Size 828KB
- SHA256 a5eb7038ed956bad7704a722f05691474ff709dffbad92b8e31dbb869ad58334
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/bn.pak
- Size 1.0MB
- SHA256 87670ff2ceb1ebc38fce2c3b745ac965f3de5de3133d99ed33933a8f3e99d874
Score3/10 -
- Target locales/ca.pak
- Size 503KB
- SHA256 d9c45d55a9a5661063b9bbebb0615de8f567f3925d04fd10938da9617c6220e0
Score3/10 -
- Target locales/cs.pak
- Size 518KB
- SHA256 397134d1834f395f1c467a75d84ef2e8545cb0f81e94dbe78b841fbbdaad802d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/da.pak
- Size 468KB
- SHA256 0b9da7bd6531a7ebe7d8188b320c0953adcfbaf654037f8265261a12e63d3c87
Score3/10