General
-
Target
Bloxshade.zip
-
Size
3.8MB
-
Sample
241111-qzet3atjfm
-
MD5
24223bde0e563e3f186b0b2a51c694e6
-
SHA1
72bd910ae7a271dbde8dd9cd65602fe9c48fea61
-
SHA256
9410e9dd00e952a4b8874a8ba2443644a3b8ee87b4021cd47b029d25e53fabe0
-
SHA512
4dddc46dc3e0e52d5e4afe5d988ee01d431cb3a4df2371c825e6e16dcf17cad9ea6d9d7649f8909f15a184d33c1ed35e84f57f811aca9c554d7e78b98e73d9c5
-
SSDEEP
98304:ouhpwm2tdcUkkfOxCpjP69LxMe4dMdRtoXeqlImf/vflEVfWuCtm1o:NUTcBmO0169LxZoMzUTHvflE1em1o
Static task
static1
Behavioral task
behavioral1
Sample
Setup - Bloxshade.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Setup - Bloxshade.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Setup - Bloxshade.exe
-
Size
9.2MB
-
MD5
54463ffb5463d17acc2b34771383e07f
-
SHA1
7b163fceb569dcebd5bfdc10aa1e34759154abc5
-
SHA256
acdae4c14010207f9b2960e91f14caf95a71a16a38105ea9136316fa9ce73f71
-
SHA512
879273a9e507e7f1f6465bbac561f4a3326fb299abf6a5f3a31a1284e94aad20e2985e95a78f7ed0c515cb4eaaf7923fc4c9550038d1dbd1a49c67b02639787f
-
SSDEEP
98304:XzX5RzYzAWt0q/G2Asj4xTN+ZD/JdWLM3S43f4nSs:Xzswq/osj4xT2/Jk43DP4nr
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
A potential corporate email address has been identified in the URL: Caveatwght@700
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1