Z�11@��3����T�t�.t �G�0�|[�� ��O *y�ّ�:�S��%��络I�H%��֘������@v�I'�C7y� Ez�c��#h�Z�{H����Z������$�:]n�'�Qͼ`�7�G�� 7���u4G�Z ��(���[�����f=ƽ�8U�{o�=zL�M�Z�ޙѼ^5ތ0�r������GP�l7�P7���r��S��'l��g��ʕI�'���r����Y��������E4�vmx���/��K]�������|�e���r�тd�-hR� މ��ulj����e�N*�=V�Sk���S*j|ʊfqlqҖ'���{�O���lVĀ�����V�QB��#�X��&F߫3��T��?��o�aq�\H-Oך���w4Tm����So��-�z��I+z7v��^�ͩ따�ח��"j-ϤM��ǯ{�D|��a���/��_=�䕁Fd*�1���"VU����S��a�����Ve������kU�p��pXy-2Q�?Kt��'w��*_��O�ì����}�����'[q� �� ��t���dkM� �?8~WJ�ǜ�Yz+��@��攈�9B�>:c��Ds����w����A��+"��N��Y��bwl;�\�ӭ���\}��`V�a�?W��MJD�ȹ��%L����r��<J��Z*���8W���ZUҎ�������'�FK$�8!l�$d6�6��\$���������2h8�Fd�ܘ(;(L���-,����gF��喢E�u�e�*�S^� E5��ZgI��_�Q��~��ZG}d�n����J�M�y��ń+dg�&-B���T����Uf�W�`�;�kf5;ׁ���������<�く���B���= &�N����ȏ��(��5'�k�o��+���K�i�O3����w�u�ZV�D�O �A#�s��_[jZx'�s�����g�1�R(�"�k���7��p��L\��B����*u�A�1�(�o�au�.f*��eY��,3{�F�G1�K%UuKF$��F�m����n_�~G:r��wާ�%����è��Hz�� q�a<v<O�[�6"��(~,�X5���=gϺ8���66����"Lu�׀6�Q��lL�����_�>,pr7ܟU��N ��9�P�yγ�d�4l�@��o�T���(u��D�L͙�_���x}�5�'4���6�e���u�N���'y"���v$д,�\rG]���P�U!2�C�A��;��E�f�#M��*���f��e$�U}�XIl��0���;D�Ĵ{�e��c����v�.؋��V|��ƃ9]���@9S\AƼ�}����V�>)��P�&SuL��Qu5�[.8ș�1e?�V����w_Br�l�ml���B�N�+�'��C+������qU��Ǽl(~�fM�� -�3�P���Z1y����������F`/���4?4��a+ ���Lan��0%�TnO�cE��� �.��fo�l��6K}��Ax8�xﯾ?�������M�F�i2^M@�2a�\�'�s�tœ����R��f��Zy����ۺ��ĸ��ƨ����48���1v?�*$ȫ��(pE�����!<���Sei��NZ��.aTq%h� B)��(}e�ԧ��96����� �ZW�<4"xnL����/�T�ˎ"��e�J|�S��H��B� ~&i�X� ��d��"��.�Ci��=�:��'��s�=��$��,��V���}�d�V!���#DY$ j���e�k��_�=��~lR�R�*9�yZv�̅<��"��b�Y���s3�����GU���U����k>��ߎ�#I ���8���؊>�;���x*-��<Œ�����������LF���F��K��gԡ3�DV9>�^0�+2����m�b��Iir��hYw]�,mP;�C��0o�n抳��>���~%���� !|�}|*�SV5�b� {3� fJ�z�-쟟�gc7��V73��=��u�1D����z\��RI@ۘ6�M�P��3��r\n��$o�oig��'�U(�5��kzd@�h�{O��.�.��e�*o��\F�ז>���r��i�F����Ɯ�e�N��_*5�n}.��9�{�j��m�+U#���N��Y$�������l����Yo�g�ϑ��A�5�����#k�Km�S>�|�v��c�U����C?���T� ��47gV���֯���ޢ������S���k+oG�m�cs5~,���`����m��@�p�Shr�|��E�<�_����~�ҙ�G�>(�4w�[6D�)>�D͍ BʯsDK#���+Рx�ˋ7�~\غ�Q��KL��C�) /v�F��.�_;~�턧��X� N����o�C9e��J�ڿ<v�ay���9����)�h�^�V��c�^�p�4c��\���5���fl�����թ"�.�L3�:1���L�ah�Sx%ȝa�E?5*x�I/#π��bL�#S���t�� Y�<�a�ތ��cꥮ���H.MTĊ� �A�s�.��� �]�����V���t��p�]Z���2�i�8���a���� FAd���GŜ�XBz���%!X����3��m��̤�%��M�@S�{�r�r�GX�'�O4ux)e�Y1<4�cU��>ר��B,�Ӥg�����4P�>���ZZ�{��rH���[w�E8~6�1�'�]4 ��Dk,qڻ��0o3�5��� �KD��,� .����f���_���x%�HUhxJ���w���=:=�����(Q��(�;���W�I��&���3QnR��B=�K60��U|l$v�l���[�d&3*f�\�<x ���h�t�N�5�2��4�D���fd��]�ʰI��t�G�=���GWLH!i�& �*�x���,�D����!� k#���^'��L⦱��$ �Ce؍�m^�0�D��\�����iI���yW�i(��#���:��ޚ ��aG,�#��=��c�b������ċ�' �z ��%
Static task
static1
Behavioral task
behavioral1
Sample
BloodHunt.exe
Resource
win7-20240729-en
General
-
Target
BloodHunt.exe
-
Size
18.0MB
-
MD5
37afd3c9382446624577cdaccf9de3be
-
SHA1
70c9526a27e6b60844eea617b51494f83bd6a14c
-
SHA256
843885dea119f15af2cab10bf788f1a051ebc5e441344c2cd0a38e4ffc86a101
-
SHA512
cab42cb88143d8499e6ac199a19d1467285f5bec7590fd808ce3c5c21c42153fc6b4a9c2f122ca1acc65f85fe5a75216dce0bf48c4103d03c445e66bf8bd0ffe
-
SSDEEP
393216:q9N5yOhqv2/QYijASDrt3V/kli73IlsSn6LVpODAbKs+hHX/MHM+:QzRqu/DGrJ2sr2n6ZpwuK79Xc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BloodHunt.exe
Files
-
BloodHunt.exe.exe windows:6 windows x64 arch:x64
f8098c2fb9a2c9e3442301c2f93f89d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
gdi32
BitBlt
advapi32
IsValidSid
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
ntdll
NtRaiseHardError
shlwapi
PathFindFileNameW
wininet
InternetOpenA
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertFreeCertificateChain
ws2_32
getsockname
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
strerror
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-environment-l1-1-0
getenv
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 255KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.58+ Size: - Virtual size: 14.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Yz9 Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.B6t Size: 18.0MB - Virtual size: 18.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ