General

  • Target

    BloxFlip.exe

  • Size

    702KB

  • Sample

    240209-sq76csea69

  • MD5

    5e8eefdad5b8ab9b1b47f269ca27d8f7

  • SHA1

    ba66cf53cfe996d904e57b9409b349da62bb5d27

  • SHA256

    e915dccc9e65da534932476e8cec4b7e5446dbd022f242e9302ac18d2a041df5

  • SHA512

    3f353dd053e4cd18cb7c56237230d026404a8c217084e740b152ff3e9e3c8ecf0649dbdc5e98617d82086f2b340588741c7afdf4326e1f6bf56242bf7a8c58a8

  • SSDEEP

    12288:uQjtwieaRtNsy+vMyX/A8MAnz8gCWxjijlLRjPrDuTsu3WfRme3I:uQjtQatuVY8MAnzCM2RjziTsuERmoI

Malware Config

Targets

    • Target

      BloxFlip.exe

    • Size

      702KB

    • MD5

      5e8eefdad5b8ab9b1b47f269ca27d8f7

    • SHA1

      ba66cf53cfe996d904e57b9409b349da62bb5d27

    • SHA256

      e915dccc9e65da534932476e8cec4b7e5446dbd022f242e9302ac18d2a041df5

    • SHA512

      3f353dd053e4cd18cb7c56237230d026404a8c217084e740b152ff3e9e3c8ecf0649dbdc5e98617d82086f2b340588741c7afdf4326e1f6bf56242bf7a8c58a8

    • SSDEEP

      12288:uQjtwieaRtNsy+vMyX/A8MAnz8gCWxjijlLRjPrDuTsu3WfRme3I:uQjtQatuVY8MAnzCM2RjziTsuERmoI

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks