{
  "family": "swizzor",
  "sample_count": 55,
  "category": "adware",
  "description": "TrojanDownloader:Win32/Swizzor is a highly sophisticated, notoriously obfuscated trojan downloader that emerged in the late 2000s, primarily serving as an Initial Access Broker to silently deliver massive amounts of adware, scareware, and secondary trojans to compromised systems.<br><br><b>Understanding Swizzor</b><br>To the end-user, the initial Swizzor infection is completely silent, only becoming apparent when the machine is suddenly overwhelmed with pop-up ads or fake antivirus warnings. For malware analysts, Swizzor is legendary for its severe, polymorphic obfuscation. The developers utilized advanced server-side polymorphism, meaning almost every single binary delivered to a victim was structurally unique, rendering traditional, signature-based antivirus nearly useless at the time of its peak activity.<br><br><b>Execution and Evasion Strategies</b><br>Swizzor was typically distributed via drive-by downloads or bundled with pirated software. Upon execution, the primary executable (`T1027`) is a massive mess of junk code, anti-debugging loops, and encrypted payloads designed specifically to break static analysis tools and sandboxes (`T1497.001`). Once it finally decrypts its core logic in memory, it reaches out to its Command and Control (C2) server. It then downloads and executes a continuous stream of secondary payloads (often adware like Lop or Cydoor, or fake AV). It establishes persistence via randomly named Registry Run keys.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely compromised, bloated endpoint. EDR platforms are critical for catching Swizzor, as they detect the *behavior* (a newly dropped executable reaching out to the internet and spawning numerous child processes) rather than relying on a static signature. Incident responders will observe a sudden spike in HTTP traffic downloading executables to the `%Temp%` or `%AppData%` directories. The presence of highly obfuscated, large executables with random names is a strong indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1112",
    "T1027",
    "T1497.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the continuous downloading of secondary payloads.",
    "Do NOT rely on a single AV scan; due to Swizzor's polymorphism and payload delivery, the machine is likely infected with multiple distinct malware families.",
    "Capture a forensic memory image to attempt to extract the un-obfuscated core logic and identify the C2 domains.",
    "Due to the sheer volume of secondary payloads dropped by Swizzor, a complete, clean operating system rebuild is strongly recommended."
  ],
  "what_to_avoid": [
    "Do not assume the threat is contained just by deleting the initial Swizzor binary; it has likely already downloaded numerous other threats.",
    "Avoid wasting time attempting to statically reverse engineer the initial Swizzor payload; the obfuscation is exceptionally complex."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}