bced4bf4912737f69cba975ca1521ffad5e74653684022df5e6171cc60cc094e

General

Target
swift.zip
Size 14.9MB
Sample260815-2c2k4avbph
SHA256 bced4bf4912737f69cba975ca1521ffad5e74653684022df5e6171cc60cc094e
MD5 417bd0e0d1470f1cd45d2b1f59990145
SHA1 31debb210d134270356f65efcaede9b590d8a240
SHA512 3863b7fbbff709b81fe1fe6e2061505a0891da1edf67f2e3528f63daab8eb272537a0e10b93683c75718b89a797b8d0e7fa90e8faebc9503ff613b10fd77f54b
SSDEEP 393216:8bVsGesmWzS7WA7+i2U1wyVObve+Rt1o5tlt2SeX9:8bVrepWzgWJ66P+tl4X9
TLSH
T125F63307CAD0322BD5A85476195EC8ADD0FAEE87B50AF7733872CDA3CA453D0855FA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Swift.exe
- Size 13.0MB
- SHA256 a6392ee4b34c64a366500cb050478049560e6acbb02c20077d38f3d5ee5497d1
- MD5 1f22eb0a0742c95cec82a91205411797
- SHA1 c36230783fb1039857a99e401ded02158c955360
- SHA512 c29201c7ef9a63268731d73511fbeb2f694749677bee45b38fb2b9d9db7dfe382f8bd8e6ad2191379d69ed116f2a6fdbf48cf2c437bae935cfe03a7df131171a
- SSDEEP 196608:K2KWwCM6GV/pekczMb5b/bnUMOcvRYKdEL5jKxpw9bWQ:K2KWwCM6eHczMNzzUxmRYKdElevw9qQ
- TLSH
  T195D67C217B8A99ADC05AC470838647726E3170DB0B35BAFF45D486793FA9AF41F3C258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  bin/Dll3.dll
- Size 6.4MB
- SHA256 738787ac7f851fbf63ec46d576f23b7aa2e190daf33bf13fbd8354b693a4f437
- MD5 04c88b5a60dbb32b960a6706556b47ce
- SHA1 6b249ffe516a53a0682412f76a736b11d4e420cf
- SHA512 7fe565c2520878c4c2471f66447c8f0bf5727ca9cd1cc88376db72038a301aa4afd2ff3006a98968fc2b727ff6cf679d67d8d1431565b2e045d0a3ade8b32ce2
- SSDEEP 98304:NoYJChbWll55iEV/RXFxvBg35fsSsxdo55iPWAMDgTLjRCr:NoYJICd5iEV/RXFxvC3Dsx8V0tCr
- TLSH
  T16866CF6AA3A411E8C47AC178C5675607F7B2782D0370A7EF23D19B652F23BE1963E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bin/injector.exe
- Size 3.8MB
- SHA256 5e26a7916cd0e7f46f48cb5cbe6c5e43e550968e976e21710aa8fd1146f0f60f
- MD5 827fe21c18af864574c8bb24a783c84c
- SHA1 c3909db13487bb37b7ff0ad4da46862da3ca757e
- SHA512 59699a40c04de5052a1b8fd7f6968c8303916a46285b0eef1df35a282284add7f793ae3148fd563e292c2c6840678857435959b1830d5aa7759a663d086c688a
- SSDEEP 98304:lcY38DhXAFmLTkDaeG9VgXDxX7cs+wAzzDYiGdc+x1umC:lsdXLoueG96zd7cs+wAzzqpomC
- TLSH
  T1180633033BE7BE27EF986FF3861E712F9152E2CE998A975C5D0D093B244411E08568BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6