Loading malware…
SWORDLDR is a shellcode loader observed in intrusion chains associated with Earth Baxia activity and in the first documented in-the-wild deployment of the Charon ransomware family. In the analyzed Charon attacks, a legitimate binary renamed to Edge.exe (originally cookie_exporter.exe) sideloads a malicious msedge.dll identified as SWORDLDR. That DLL checks for DumpStack.log, reads and decodes it, performs anti-debug checks, extracts shellcode and API names, and launches the next stage by creating C:\Windows\System32\svchost.exe in a suspended state and injecting stage-1 shellcode. The loader resolves APIs such as CreateProcessA, VirtualAllocEx, WriteProcessMemory, GetThreadContext, SetThreadContext, ResumeThread, and VirtualProtectEx, and performs process hollowing by redirecting execution to the injected shellcode. The shellcode loader is described as decrypting the payload and injecting it into a specified process according to embedded configuration.
In the Charon chain, SWORDLDR decodes DumpStack.log using a per-byte transform involving bitwise NOT, XOR with 0x2E, and 8-bit negation. The decoded blob contains API names and the target process path for svchost.exe. Subsequent shellcode stages resolve ntdll exports, decode and decompress additional shellcode, and reconstruct the Charon ransomware PE entirely in memory. The final payload was not dropped to disk in the analyzed case. Charon then performs anti-recovery actions, targets backup, database, and security-related services and processes, enumerates network shares, and encrypts files using Curve25519 and ChaCha20, appending the .Charon extension and dropping a ransom note named How To Restore Your Files.txt.
SWORDLDR has been linked in reporting to Earth Baxia, a threat actor suspected to originate from China, though Trend Micro stated it could not definitively attribute the Charon ransomware operation to that group. Related Earth Baxia campaigns targeted government, telecommunications, and energy organizations in Taiwan and other APAC countries using spear-phishing and GeoServer CVE-2024-36401 exploitation, and recent SWORDLDR samples were associated with that activity. In the Charon case, the broader campaign targeted public sector entities and Middle Eastern aviation organizations. High-confidence indicators directly mentioned for the Charon SWORDLDR chain include msedge.dll SHA-256 e0a23c0d99c45d40f6ef99c901bacf04bb12e9a3a15823b663b392abadd2444e, Edge.exe SHA-256 5d0675f20eeb8f824097791711135a273680f77bf5e9f0e168074e97464f21b5, DumpStack.log SHA-256 739e2cac9e2a15631c770236b34ba569aad1d1de87c6243f285bf1995af2cdc2, and another listed recent SWORDLDR-related sample SHA-256 db425ce989ff1e2046f5ebddf2472dca8c48ab987e632e66caabf86502bf3ef0.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A legitimate binary renamed to Edge.exe (originally cookie_exporter.exe) loads a malicious msedge.dll (SWORDLDR). That DLL decrypts and launches the ransomware payload staged in DumpStack.log.
The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload.
The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
At start, the shellcode resolves ntdll!LdrLoadDll, NtAllocateVirtualMemory, NtProtectVirtualMemory, and NtFreeVirtualMemory... Selected API hashes resolved by stage‑2 for injection/execution: NtGetContextThread, NtOpenThread, NtSetContextThread, NtResumeThread.
The ransomware leverages techniques such as DLL sideloading, process injection, and anti-EDR capabilities... "The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload."
Charon also uses a multistage payload extraction technique via what appears to be a benign log file, DumpStack.log. Upon closer inspection however, this turns out to be an encrypted shellcode responsible for delivering the ransomware payload... Further analysis also revealed a second layer of encryption within the intermediate payload.
CreateProcess(... CREATE_SUSPENDED) + VirtualAllocEx / WriteProcessMemory / SetThreadContext / ResumeThread T1055.012 - Process Injection: Process Hollowing Inject/hollow into svchost.exe and transfer control to staged shellcode/PE.
It checks for the presence of DumpStack.log, reads and decodes the file into payload_shellcode_layer_1... Stage‑2 begins by XOR‑decoding and calling RtlDecompressBuffer to produce the Charon PE in memory.
The ransomware leverages techniques such as DLL sideloading, process injection, and anti-EDR capabilities... "The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload."
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious DLL sideloaded by Edge.exe that decodes DumpStack.log, performs anti-debug checks, resolves APIs, and injects stage-1 shellcode into svchost.exe to launch the Charon ransomware chain.
A malicious DLL loader delivered via DLL sideloading that decrypts and deploys the Charon ransomware payload, including injection into a spawned svchost.exe process.
SWORDLDR is a malicious loader used to decrypt and inject Cobalt Strike shellcode into target processes, facilitating in-memory execution and evasion of security controls.
Referenced as a recent SWORDLDR sample in the file information section, indicating use as a loader in the campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.