69f2acfa7e266a460567e2d4c3724f85d7565f8b2622fc096d264184051b3974

Sharing

Copy URL

Twitter E-mail

General

Target

Blitz-2.1.202.exe
Size

114.0MB
Sample

240824-tqwyrszfmj
MD5

2dfa6604a2b84d63b297e42e3ec0815b
SHA1

11fe9f2fb09b4be8bbd17f35d9687dba3cd568f0
SHA256

69f2acfa7e266a460567e2d4c3724f85d7565f8b2622fc096d264184051b3974
SHA512

e602011301de6ec5e7dd83c439dbe33c4a01fa73e679fa3274cd65f7227461458d9f5d9e1f203273602bc0e493b027a2fd64584eb4d16a34274f61b1b16541b8
SSDEEP

3145728:ScKJkSU6xje4F7DbzRZG+Afxi7HNTmy5pEL9fGN:PKkm64F7Dbz3ewhOQ

Score

6^/10

Malware Config

Targets

- Target
  
  Blitz-2.1.202.exe
- Size
  
  114.0MB
- MD5
  
  2dfa6604a2b84d63b297e42e3ec0815b
- SHA1
  
  11fe9f2fb09b4be8bbd17f35d9687dba3cd568f0
- SHA256
  
  69f2acfa7e266a460567e2d4c3724f85d7565f8b2622fc096d264184051b3974
- SHA512
  
  e602011301de6ec5e7dd83c439dbe33c4a01fa73e679fa3274cd65f7227461458d9f5d9e1f203273602bc0e493b027a2fd64584eb4d16a34274f61b1b16541b8
- SSDEEP
  
  3145728:ScKJkSU6xje4F7DbzRZG+Afxi7HNTmy5pEL9fGN:PKkm64F7Dbz3ewhOQ
Score

6^/10

discovery execution persistence
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/app-64.7z
- Size
  
  113.1MB
- MD5
  
  b28c057e25f4bd108387849558fdadeb
- SHA1
  
  85ad3da4aaeaa1050d816ffd26978f10d1f1652d
- SHA256
  
  93186852355d9e71510103cb4616a07946ef1f0c21d05f7260287df90c9fcd52
- SHA512
  
  9dcf1190f236396fcc79ae2b34937aca35590abdc388c06f80f1c7ea17699ae90aee9a1a95873d64c14483285462af642dee89ca0ed917ae75599863e40c8c73
- SSDEEP
  
  3145728:LKJkSU6xje4F7DbzRZG+Afxi7HNTmy5pEL9fGc:LKkm64F7Dbz3ewhOZ
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Blitz.exe
- Size
  
  158.5MB
- MD5
  
  cb8cdcb6ca5d4413c538df7961ef028c
- SHA1
  
  c8cd271d4f69768636d4fdf113f30dc105cec2fb
- SHA256
  
  a1a9751ef2d43feeb71e535f6699c891e0f4cbc3893dbdeaaa345ef61e007ab0
- SHA512
  
  4e8aa298b70ce23c4dce55e05651156cefb2dd7dafd588a0ff23981bb3db389e8f09edcac044f7faf3921bda41936c59678bf1590fb4c5111e0447e1ed4f8814
- SSDEEP
  
  1572864:3yJTch4m3smRNthV6oaFwCtdmVoTOelJCgn/v2lfJsRhWaB8hONXoyJ2eZoCGGUj:37o51oeUR
Score

6^/10

execution persistence
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  0378f24b66466d7ab3321e4ac34805b7
- SHA1
  
  7ef73f565d3a9f8b1f5a4a2b994442b17c28923a
- SHA256
  
  614b2d4a2d57a0765f92ccafd75d493b1aefb24af0999d10a2b90b4d4a7edb8f
- SHA512
  
  0f0e0fc8731e15e4d68cdd24a65a0f10c4f73ce786a7321fe2ecc0664e242026ec28e762a91604e09f8bfe6f90230f05a80195b442da8c3e215f6b282a05d093
- SSDEEP
  
  49152:B0h7iln3U9ZzcZ90CvaQL3nm2+hTf6yfPvJr8PNSt2wLlDZMkSfqFD:Bnke90dCnmMyMkS6D
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  f333553c6bf378ebb7164b83f9234d63
- SHA1
  
  44c0527f84f8e8b6d55eab5b3db8c30ba063f28a
- SHA256
  
  3c543255d163f16c7c15431a11748341edbe6a68e1e6b4eb468b244b5ff7d745
- SHA512
  
  28e295c1051a7009ba6d8f42d764f9844a2861e95ae9a3fb19a7403d4275a520e610021be9987bafc3182693550058e34625c7c68200958c35ed014ee51dc1ea
- SSDEEP
  
  6144:EI9l96ELjw9883JfjMkV2iQQEdU2syTqW/:EClYEQq8ZfjMBSoT5
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  c0c388a24861df09f5b91f116933585d
- SHA1
  
  94cfc73e0dc8afc63b3c258da911cd1e00b94abb
- SHA256
  
  4443baaaa9720421bf851b623d885af25ed9d322827f8ca096b5ab76d2ca772e
- SHA512
  
  8ba380bbdaa5bf69047e6d371b10e95dddfa4f641446eb45875c3dbb2223ad7a0a7c2c6d725608d36f7836caafc874b926b5f71d1fcb8ad4e741b35e2ed46274
- SSDEEP
  
  98304:IAgpTkR1Ff1SCUDuVyALwkQyx9StmZC5wXVY7D:T9GPc+kgcLY7
Score

1^/10
behavioral20 behavioral21
- Target
  
  resources/app.asar.unpacked/node_modules/classic-level/prebuilds/darwin-x64+arm64/node.napi.node
- Size
  
  631KB
- MD5
  
  b1a2256fc3a83e4c38701dd8601799bf
- SHA1
  
  992a59c72740c0069693365a25e9b90705cb54f3
- SHA256
  
  18b01d23ed59caf184d3236597d786190fd00dfd1b60b47827b6016aed4a0a6f
- SHA512
  
  7a1d9b8d73632c2f78718fc9ef3ec0e95f40ba5daa9a8542d2a8d4291c155431ae4d8c91b74453f2eb8e40ef0d57be91e25a0c9bad10b295cbffb068eb52a913
- SSDEEP
  
  12288:DP7t/ckazbcaodBk6gw9SY4jLpnOcctcr+gg:DP7t0kaU9k6dyr+P
Score

4^/10

evasion
behavioral22
- Target
  
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/darwin-arm64/electron.napi.node
- Size
  
  227KB
- MD5
  
  d9d08aab6b8f1725e7e79819b0ed52e6
- SHA1
  
  bc08e98564462675100b8c244e45b6dca7f504e0
- SHA256
  
  b322385eb19c1d0737144fbe2fef3c5d27b5e5531878f5a21700489785e51ac4
- SHA512
  
  3abd4ffc4b04a0bb2c46a2f60901728587b116b0cd9aab15d77392cd70118f2d6f03abbb172d01e162596fc5a205a38003b3025d59587ea565c10b29d84b4eb0
- SSDEEP
  
  1536:v1C0Ui3WiUnwp8O+yctEf5yaXxIv9+noVf9CHJMKZNKO8rkz8Ka+eveQidqRFX66:vn0nO+yc6xyff9ZOekz8LeQi5kBo0QW
Score

4^/10

evasion
behavioral23
- Target
  
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/darwin-arm64/node.napi.node
- Size
  
  227KB
- MD5
  
  d4757cb9d3db465324fd6d209159c3e1
- SHA1
  
  d7e219800ffa8913b7ad75720ab9771a0cfe536d
- SHA256
  
  7eb79b4ace336fc1f31923f7407d997d2676f95a5fab4a3dc4688be2ed659f1a
- SHA512
  
  9564008c36fe2610224103c0300cd8616ccb5d1d92eccee20124369bdc2267fc9261de103c1be50d34328493d96f90195ce7ff3fd73b006f81efaddc0c5246fd
- SSDEEP
  
  1536:kMV8yurSTug6X+YIytNX1yQsdjesJyaXxIvIPegMwI0v4JMKZpKOz5Skz8KoTwNv:/MTOMtLsd6Gylr0fOzUkz8yNLokBo01
Score

4^/10

evasion
behavioral24
- Target
  
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/darwin-x64/electron.napi.node
- Size
  
  434KB
- MD5
  
  7ee8fd865c9bc4cf48a3ffaa31c5c83f
- SHA1
  
  c3b6eab72a5a365470b9c093917a072ea50f19ee
- SHA256
  
  37713bcaf2468d4a60c94652dd2ed8801fff57f270650b2fee90428bc5ad290a
- SHA512
  
  a18d1bbdd3345090034dab3400cebf5aecbc080e6dc358d63dc448e2f20cab3aa95d967a3f3af013a6c7e8b957a5a7b79e68fdf3cc089c5a3d8b5837d222abbe
- SSDEEP
  
  6144:PIZDPb40mHBIYtFnUI5uyMLqVTQ0NYOBB8rZ25Ezf/nYvkBq/F:AZDD40mIp0NtkrZznK/F
Score

4^/10

evasion
behavioral25
- Target
  
  resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/darwin-x64/node.napi.node
- Size
  
  434KB
- MD5
  
  001fbb6d0df309b30eb8d164dffe5b3d
- SHA1
  
  ebc50ac789a7d5541162365de2dc8fd45da01b5e
- SHA256
  
  5c77fb5f183ee197b110c76440b390d74aae7c35ab1ea48861308d8b62c22f65
- SHA512
  
  46ef76780c0c0c2c1a1b524708f66fa2f53636cc46fcdbdc3aa572423beece14cb040d0e943739f1a32eb381689d72e06d38789b59ccce5f694cd64a9007fdac
- SSDEEP
  
  6144:OJ3wepZY9h8c1IYtFnUI5uyMLqVTQrNYO0BYrZ6+EzfdXYvkBy/7:OhwebY9h8/prNtprZOXS/7
Score

4^/10

evasion
behavioral26
- Target
  
  resources/binaries/apex-internal.dll
- Size
  
  3.3MB
- MD5
  
  656d04ce4deb3de39153c95c5cff1336
- SHA1
  
  d1fa67170d30d99de95c48626ebbb381389b5e8b
- SHA256
  
  325cadb7e9f61c960c49a03ef916f178c910bdc6c134a43f0b208d14751136ed
- SHA512
  
  2692d8994c7ad07db8224ab70df557b33e9953b27da9ec2636b0b95669ce3eae6ceca4df7d191a2ca9f2c7cf0c190e2a0d00fc365f546cf8f2c6e855d4d23e25
- SSDEEP
  
  49152:IDyazC/kc3XTmKN7kAwerFnDuRjIP2OQyXmkTiZGi:lBfNoAwM2WXmkTWGi
Score

1^/10
behavioral27 behavioral28
- Target
  
  resources/binaries/blitz-csgo-external.exe
- Size
  
  3.1MB
- MD5
  
  d7315f3703e3673046da360d74cfde0f
- SHA1
  
  675e3b2b1bc9618c40418cd76905d5cc208cdc52
- SHA256
  
  3118b7128f59f7df95766a04943dd5c6ed47fcc963b3f6a5bd350cdbda01da0c
- SHA512
  
  e4b23bd32f2f588dbac45ca757ffe6a99679e288877e0ff117b514c0ac1ad771b8b17851f5d0a3251e76bbdd90787366a91cb4d5548efd8c4f0ad168448e782a
- SSDEEP
  
  49152:i/clNcWI55wBgODVGLJn6HpAyP2OQyXmkTiZGV:5w5CgkVF2WXmkTWGV
Score

1^/10
behavioral29 behavioral30
- Target
  
  resources/binaries/blitz-overlay-old.dll
- Size
  
  3.8MB
- MD5
  
  904f402532004edab7e88a0a8adb7de1
- SHA1
  
  32e5da14f6d94d6840378b85617e5a50034d2a75
- SHA256
  
  5ccca21c796b09baadd63a044d30d9cc0b8d50fa0560cdd432c40cec7c3643c1
- SHA512
  
  40e7ebc4167b10cc6d858264866ffd9140180ae26e7c4a53322bd878317b35bdeaea1fe35f7beb52bc5dbdf95140887c37fb40ff93d0046bb54420ad181b7470
- SSDEEP
  
  49152:vvGTcpkzfX+2Wj+qNYESLxaGwcxQG5UtVinTUz0WIz/Nk8P2OQyXmkTiZGD:mNNCG5Sd07NV2WXmkTWGD
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Checks computer location settings

Enumerates processes with tasklist

Adds Run key to start application

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32