General

  • Target

    Bloxstrap-v2.8.1.exe

  • Size

    39.1MB

  • Sample

    241031-rpp3qa1nbm

  • MD5

    73bb2376a421ae95bd80ba771aa12a8d

  • SHA1

    80f0bf687745df6be5d020d7b02eb7d3688276e2

  • SHA256

    adba4cdf8934918375e707312fef6a00a6b057105baade9f405ad52db4a34343

  • SHA512

    35794af776229cd986428ad5fed0e68d6756233a4c4a440858c6eff087fc2a75dc96039b67a27ba25807369942d3f70fe4ecc1cb434bcf1d87f794f07067da79

  • SSDEEP

    786432:mVl8ZGKlI8+W8YHiBtAjwlaOizcY87HC5glynXAWtXeRplFGdlQRba:xGKlKWLHe0BlE7plilerlFGdgb

Malware Config

Targets

    • Target

      Bloxstrap-v2.8.1.exe

    • Size

      39.1MB

    • MD5

      73bb2376a421ae95bd80ba771aa12a8d

    • SHA1

      80f0bf687745df6be5d020d7b02eb7d3688276e2

    • SHA256

      adba4cdf8934918375e707312fef6a00a6b057105baade9f405ad52db4a34343

    • SHA512

      35794af776229cd986428ad5fed0e68d6756233a4c4a440858c6eff087fc2a75dc96039b67a27ba25807369942d3f70fe4ecc1cb434bcf1d87f794f07067da79

    • SSDEEP

      786432:mVl8ZGKlI8+W8YHiBtAjwlaOizcY87HC5glynXAWtXeRplFGdlQRba:xGKlKWLHe0BlE7plilerlFGdgb

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks