Search
Feed
Search
Open menu

SWIFT E-mail Leads To Evasive Gootkit

Share on LinkedIn Share on Facebook Share on Reddit Share on X Share by email
Illustration of a grey Trojan horse on wheels rolling toward a target ring containing a bank building, a payment card and a figure beside a dollar sign.

We follow the trail of another spam e-mail. It’s delivering a malware downloader that’s 0/63 on Virustotal, not unheard of these days. The e-mail had a PDF attachment SWIFT-MT103.pdf which itself was innocuous and simply displayed a fuzzy scan image, purportedly a SWIFT request that linked to a file hosted on Box.com.

Tactics of the downloader/dropper:

Contains functionality for read data from the clipboard
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Detected TCP or UDP traffic on non-standard ports

Sample file is different than original file name gathered from version info
Internet Provider seen in connection with other malware
Icon mismatch, PE includes an icon from a different legit application
Reads the hosts file

…and many other warning signs shown by the software in deeper debugging in included in the report.

Received: from vps39646.inmotionhosting.com (vps39646.inmotionhosting.com
(envelope-from <info@globalrustrade.com>)

Reply-To: <sunshineslisa1@yahoo.com>
Date: Tue, 12 Jun 2018 01:42:52 +0000

A copy of the original e-mail received to a honeypot spam account:

The original spam email as received by a honeypot account, posing as a SWIFT payment notice

Download the attached PDF, and examine it finding a link:

Download the file from a box.com link, and unzip the contents:

hxxps://cambridgecommodities.box.com/shared/static/4yr4v2uaa43835jqi0lawo204oydj2d0.zip

The executable unpacked from the box.com link the attached PDF pointed to

Analysis on the dropper downloaded from this link:

SWIFT MT103 Joe Sandbox Report

or directly from Joe Sandbox if you don’t trust my PDF.

Joe Sandbox behaviour graph for the SWIFT dropper
Trojan profile from the sandbox report, listing clipboard reading and screenshot capture among its capabilities
Share on LinkedIn Share on Facebook Share on Reddit Share on X Share by email

Share your thoughts, leave a comment

Your email address will not be published. Required fields are marked *

You may also like these

Cut-away illustration of an office at dusk: a senior engineer on a call raises a hand to wave off a junior colleague leaning in at his open glass door, while another employee sits alone lit by a laptop chat window; beneath the floor, an IT technician kneels in a crawlspace holding together two copper pipes, one stencilled MENTORSHIP, that fail to meet.

The Cost of Asking

Many people would rather ask a chatbot than a colleague. What that preference reveals about the cost of asking at
Read More
Commuters in business dress walk across a bridge past a sign reading "TRUSTED PARTNER" while the deck crumbles beneath them and a lone worker braces the supports below; an overlaid "STRUCTURAL DIAGNOSTIC" panel reads load-bearing capacity exceeded, system dependency high, support provided by manual intervention.

Trust Debt: Operational Insolvency

Why a company can look financially healthy and still be operationally insolvent: selling more responsibility than its systems can carry,
Read More
Split illustration: on the left a polished executive presents a glossy house on a bright screen to a seated audience; on the right robots patch a collapsing shack with tape and exposed wiring by torchlight.

Don’t Kill the Vibe: The Theater of Modern SaaS

Modern SaaS rarely fails outright; it almost works. Why the real bottleneck is no longer writing code but understanding what
Read More
Split illustration: on the left, executives in suits pose beside a rocket labelled "GROWTH" blasting off over a scorched sapling; on the right, workers kneel in a courtyard to plant and water a young tree.

From Stewardship to Theater: How Strategy Replaces Soul

Companies rarely lose their soul overnight. How treating stewardship as inefficiency moves decisions away from the people who understand their
Read More
Split scene: a polished speaker presents a bar chart on a lit stage while, just behind the curtain, technicians kneel among cables and crates keeping the equipment running.

Being a Good Vendor: Why Preparation Is the Real Product

Clients are not buying confidence; they are buying the work you did before you met them. What separates vendors who
Read More
Two groups stand on opposite edges of a broken floor — executives in suits on one side, technicians in work clothes on the other — joined only by a frayed rope bridge, with tangled pipes and ductwork in the chasm below.

Being a Good Client: Why Hiring Experts Exposes Organizational Gaps

Hiring experts exposes the gaps in your own organisation. Lessons from consulting, MSPs and running a SaaS business on what
Read More
INFOSTRUCTION
Close menu
Feed

You're about to become an infostruction VIP!

By subscribing, you’ll receive a monthly round-up of the latest news. There’ll be no spam, I promise :)