General

  • Target

    Bloxshade.zip

  • Size

    3.8MB

  • Sample

    241111-qzet3atjfm

  • MD5

    24223bde0e563e3f186b0b2a51c694e6

  • SHA1

    72bd910ae7a271dbde8dd9cd65602fe9c48fea61

  • SHA256

    9410e9dd00e952a4b8874a8ba2443644a3b8ee87b4021cd47b029d25e53fabe0

  • SHA512

    4dddc46dc3e0e52d5e4afe5d988ee01d431cb3a4df2371c825e6e16dcf17cad9ea6d9d7649f8909f15a184d33c1ed35e84f57f811aca9c554d7e78b98e73d9c5

  • SSDEEP

    98304:ouhpwm2tdcUkkfOxCpjP69LxMe4dMdRtoXeqlImf/vflEVfWuCtm1o:NUTcBmO0169LxZoMzUTHvflE1em1o

Malware Config

Targets

    • Target

      Setup - Bloxshade.exe

    • Size

      9.2MB

    • MD5

      54463ffb5463d17acc2b34771383e07f

    • SHA1

      7b163fceb569dcebd5bfdc10aa1e34759154abc5

    • SHA256

      acdae4c14010207f9b2960e91f14caf95a71a16a38105ea9136316fa9ce73f71

    • SHA512

      879273a9e507e7f1f6465bbac561f4a3326fb299abf6a5f3a31a1284e94aad20e2985e95a78f7ed0c515cb4eaaf7923fc4c9550038d1dbd1a49c67b02639787f

    • SSDEEP

      98304:XzX5RzYzAWt0q/G2Asj4xTN+ZD/JdWLM3S43f4nSs:Xzswq/osj4xT2/Jk43DP4nr

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • A potential corporate email address has been identified in the URL: Caveatwght@700

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks