bluefox | impvqfag[.]ex | Triage

Sharing

General

Target

impvqfag.ex
Size

168KB
MD5

967461d7eaa06cceada0df6b90dc2248
SHA1

9b0f168f38e990dade84905f8b294e0c83a1a93f
SHA256

d6d03b39851da54f93d35a89fa243ebc01b45b6f7ed5590605d64bda89fd293d
SHA512

117873b1ca7cf78f4579611f16bc5479b12a63acfec99bd3021b67de5336254337f7c9e5f8fc202dc26109ca2dd3f1e689d15e989662a5cf1dac45d1322aafff
SSDEEP

3072:KDBXmfDngnSzsevIJqg5IOQI0HQFdWjhf7ybH0WRgg/:EXmfDgbGg5IOQIAhTybDgg

Score

10^/10

bluefox

Malware Config

Signatures

BlueFox Stealer payload 1 IoCs

resource	yara_rule
sample	family_bluefox

Bluefox family
bluefox

Files

impvqfag.ex
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ