Scan copy swift.exe
Classification: Malicious
Scan copy swift.exe is a malicious file sample (Windows executable, 501.0 KB). Linked to Turla activity. Reported by 3 threat sources, last seen 2025-02-22.
Detection summary
- 0 antivirus detections (72% detection ratio)
- 1 IDS alerts
- 2 processes observed
- 1 contacted hosts
- 1 DNS requests
MITRE ATT&CK associations
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:36:06 | 2025-02-22 09:50:57 | G0010 Turla | |
| Generic Malware | Hybrid-Analysis | 2023-09-11 01:15:04 | 2023-09-11 01:15:04 | ||
| SnakeKeylogger | MalwareBazaar Abuse.ch | 2023-09-08 19:29:02 | 2023-09-08 19:29:02 | malicious-activity |
Tags
windows-server-utility win.snake ekans snakehoseSample information
- Filenames
- Scan copy swift.exe, f79b0.Backdoor.exe
- File type
- PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
- Size
- 513024 bytes
- MD5
89d6886dacade8178843769dec377da1- SHA-1
d2ee51da58a1ffa84fe8100830862ed66320f3b9- SHA-256
f79b0934ab9dd5b547e7c88c74d9f692cca204429a0e8fc9a6ae2d6ecec1896a- First indexed
- 2023-09-08 20:17:59
- Last updated
- 2026-10-08 07:36:08
Network contacts
DNS requests
Process list
| Name | Command line |
|---|---|
| f79b0.Backdoor.exe | |
| f79b0.Backdoor.exe | |