Overview
overview
10Static
static
7BLTools 1....FS.dll
windows7-x64
1BLTools 1....FS.dll
windows10-2004-x64
1BLTools 1.....9.exe
windows7-x64
10BLTools 1.....9.exe
windows10-2004-x64
10BLTools 1....et.dll
windows7-x64
1BLTools 1....et.dll
windows10-2004-x64
1BLTools 1....pf.dll
windows7-x64
1BLTools 1....pf.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
BLTools 1.9 [CRACKED BY INJUAN]/AlphaFS.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
BLTools 1.9 [CRACKED BY INJUAN]/AlphaFS.dll
Resource
win10v2004-20220721-en
Behavioral task
behavioral3
Sample
BLTools 1.9 [CRACKED BY INJUAN]/BLTools-v1.9.exe
Resource
win7-20220715-en
Behavioral task
behavioral4
Sample
BLTools 1.9 [CRACKED BY INJUAN]/BLTools-v1.9.exe
Resource
win10v2004-20220721-en
Behavioral task
behavioral5
Sample
BLTools 1.9 [CRACKED BY INJUAN]/Extreme.Net.dll
Resource
win7-20220718-en
Behavioral task
behavioral6
Sample
BLTools 1.9 [CRACKED BY INJUAN]/Extreme.Net.dll
Resource
win10v2004-20220721-en
Behavioral task
behavioral7
Sample
BLTools 1.9 [CRACKED BY INJUAN]/Ookii.Dialogs.Wpf.dll
Resource
win7-20220715-en
Behavioral task
behavioral8
Sample
BLTools 1.9 [CRACKED BY INJUAN]/Ookii.Dialogs.Wpf.dll
Resource
win10v2004-20220721-en
General
-
Target
BLTools 1.9 [CRACKED BY INJUAN].7z
-
Size
9.4MB
-
MD5
adfb510037f2da72dbe3b077d12bf0ee
-
SHA1
b181ec66ab76e0ef2cb7fbeab7f271dd0d8ea789
-
SHA256
5e5c17140ce8829ed152d6fce28064e9f5693d789d9ffd2e6b45e330cf5f2207
-
SHA512
9c6a8772f3ec9044972b62f6e5b2e94e1283203aff6f9bbcbf91590f41b1be1e2e0a7c374b14063c8995b974dc0c507e96a90c458243c4acafcf70e6fdb25fa3
-
SSDEEP
196608:LnFoS/KFsxRJhCLZrueT1S42/OYl6uns8rsBRkt/VLox+cV:TFH/+sV6rrl22YwrZBy+V
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/BLTools 1.9 [CRACKED BY INJUAN]/BLTools-v1.9.exe themida
Files
-
BLTools 1.9 [CRACKED BY INJUAN].7z.7z
-
BLTools 1.9 [CRACKED BY INJUAN]/AlphaFS.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorDllMain
Sections
.text Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 1.9 [CRACKED BY INJUAN]/BLTools-v1.9.exe.exe windows x64
Code Sign
16:12:02:5b:f6:a3:a7:80:42:bb:ef:70:b6:9c:b3:a3Certificate
IssuerCN=BLTools By BoyringNot Before10-07-2022 05:00Not After17-07-2032 05:00SubjectCN=BLTools By Boyring90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before11-05-2022 00:00Not After10-08-2033 23:59SubjectCN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
9e:ec:b8:b2:ab:c5:eb:c9:1d:aa:04:2a:02:a7:ca:64:35:c8:6d:e8:a3:c4:13:14:99:c0:4f:ff:cb:6e:84:a7Signer
Actual PE Digest9e:ec:b8:b2:ab:c5:eb:c9:1d:aa:04:2a:02:a7:ca:64:35:c8:6d:e8:a3:c4:13:14:99:c0:4f:ff:cb:6e:84:a7Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=BLTools By Boyring05-08-2022 12:36 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 6.4MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 19KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imports Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
BLTools 1.9 [CRACKED BY INJUAN]/Extreme.Net.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorDllMain
Sections
.text Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 1.9 [CRACKED BY INJUAN]/Ookii.Dialogs.Wpf.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorDllMain
Sections
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BLTools 1.9 [CRACKED BY INJUAN]/Settings.ini