Overview

overview

10

Static

static

7

Setup.exe

windows7-x64

10

Setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8951741821.zip

  • Size

    3.1MB

  • Sample

    230202-zrezjaah3x

  • MD5

    4cae3633db9a2b6ff09d77e77d2d0cef

  • SHA1

    cbacfc9826589b679f72ee6476feb71cc2501cfb

  • SHA256

    50a20d968ac12ec915b3d12d57feea7c8ce1cbc5e0ec79c678fe2194edd34d21

  • SHA512

    bfc20a284b37ad463ad1150d20429c54ce7ab8ee53ea3ffd2c18c61c4433430f8fa92a56328ef091565f3e9541a17e165b9702bfc849039c0bd061dfe521dedf

  • SSDEEP

    98304:R0NPN+muqTLKKV8tSTDHV9JpYLrZXsZ4Dca:4V92u9TDHVp+Zb1

Score
10/10
bluefoxevasionstealerthemidatrojan

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      376.3MB

    • MD5

      38eb2b2611ed105e0a1bb9e331abb038

    • SHA1

      fa05ff8ecca6a42e15e1218c423316a7cad3674a

    • SHA256

      08e4f43424b6845ea482ac01d1094d883a1d18b631669a4d9627c77dbf7acf76

    • SHA512

      e33128a3f516c6dc903850090b546f764182a46f38563faf57029e861ae165ce45ca713c99d26a16d6cc1e3ae0d6e7c3e2c990d3b7f2a393d12243b72aa7a3a8

    • SSDEEP

      49152:XToqRjktHN+cEUoqJCCudWoCoRXb2YP4Fu7iHeCNVrMqaXsd4AC:jTRAB7Ci5OXb2YP4Fu7+eCNVwqxd4AC

    Score
    10/10
    bluefoxevasionstealerthemidatrojan

    • BlueFox

      BlueFox is an infostealer written in C# and first seen in December 2021.

      stealerbluefox

    • BlueFox Stealer payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks