Overview

overview

10

Static

static

10

tools/Blue....5.exe

windows7-x64

7

tools/Blue....5.exe

windows10-2004-x64

8

tools/Mang...UI.exe

windows7-x64

7

tools/Mang...UI.exe

windows10-2004-x64

8

tools/Mang...UI.exe

windows7-x64

1

tools/Mang...UI.exe

windows10-2004-x64

8

tools/SAS/...te.exe

windows7-x64

7

tools/SAS/...te.exe

windows10-2004-x64

8

tools/Xdg/...47.dll

windows7-x64

1

tools/Xdg/...47.dll

windows10-2004-x64

8

tools/Xdg/Qt5Core.dll

windows7-x64

1

tools/Xdg/Qt5Core.dll

windows10-2004-x64

8

tools/Xdg/Qt5Gui.dll

windows7-x64

1

tools/Xdg/Qt5Gui.dll

windows10-2004-x64

8

tools/Xdg/Qt5Svg.dll

windows7-x64

1

tools/Xdg/Qt5Svg.dll

windows10-2004-x64

8

tools/Xdg/...ts.dll

windows7-x64

1

tools/Xdg/...ts.dll

windows10-2004-x64

8

tools/Xdg/XDumpGO.exe

windows7-x64

7

tools/Xdg/XDumpGO.exe

windows10-2004-x64

8

tools/Xdg/...on.dll

windows7-x64

1

tools/Xdg/...on.dll

windows10-2004-x64

8

tools/Xdg/...if.dll

windows7-x64

1

tools/Xdg/...if.dll

windows10-2004-x64

8

tools/Xdg/...ns.dll

windows7-x64

1

tools/Xdg/...ns.dll

windows10-2004-x64

8

tools/Xdg/...co.dll

windows7-x64

1

tools/Xdg/...co.dll

windows10-2004-x64

8

tools/Xdg/...eg.dll

windows7-x64

1

tools/Xdg/...eg.dll

windows10-2004-x64

8

tools/Xdg/...vg.dll

windows7-x64

1

tools/Xdg/...vg.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tools.zip

  • Size

    93.0MB

  • Sample

    250209-mdeqdsvqfl

  • MD5

    f7eb276aa6e23ae65dccd83bdd65ee1e

  • SHA1

    c968830ef1481c908970de001c4996961579db1c

  • SHA256

    aa9fea628399566aea6b47fae693e037e22fba51902b37d525880f10cf5ee50f

  • SHA512

    cc9c5bdbe4cdd96452bb316e5956c3b54344b0df37c2f5662dcb815adc5cea6628bdb7c17f4bc8fb1f24fbc54265530dafa1ef529f2ceeab6254d160c498acaa

  • SSDEEP

    1572864:jI/szqDS0PpnNJxNmnjdRt/S1FLek4zJFiXV032kDqVWO85EArEsj+tU:c60VNzcnjdRtKfeQK32kx2UEsyO

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      tools/BlueCode Hash Finder/BlueCode_HashFinder_Lite_2.5.exe

    • Size

      10.3MB

    • MD5

      70efd6bd3d54f1da8bf7929806d56073

    • SHA1

      c5dbca3388518bff672a1ab2b7b9de383be6ba6b

    • SHA256

      1f051c15bec28fe6071d0d497fdc6bf8ea5a869f255ad7539bac2141133e1ab2

    • SHA512

      2f6f532ad299ebaf1aa17e71e64cb70297aada10d04b9e4de0ac26d93ce99878a7eb25d1dd1d3c14685ba8cf1b29302fc326cfa35b4c2664771e2d09f97e512b

    • SSDEEP

      196608:UbD+kdDNMG3Mioq+rj5W/b1TwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWz:M5hN3MvqQ8SIHL7HmBYXrYSaUNZ

    Score
    8/10
    upxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      tools/Mango/MangoKeywordsGUI.exe.exe

    • Size

      13.5MB

    • MD5

      c9efcac98e799fbb31038b1a1e58322d

    • SHA1

      af48bdea07f99738d674c4c9afcc8df23c3d51fa

    • SHA256

      49f3c3937c8ecb34e943a27a6970c38adbac54c7c56cf1f40a6cda1657299fb0

    • SHA512

      3ffc5017fff47db03534ec24e0ddccd27bb855ed8cfe505900e4c15bbb8a37206881a5eb55cc70353093ac324f2fabfaaccd6c2aa6aebe1ed82df3311adf1e3d

    • SSDEEP

      393216:F5+vVCdlcLbyGRQuFaIHL7HmBYXrYSaUNz:2Yruygt6BYESaQz

    Score
    8/10
    upxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      tools/Mango/MangoKeywordsTUI.exe

    • Size

      7.7MB

    • MD5

      030b41579c485530d125a20792ed5414

    • SHA1

      0138ef3de8f4f07bfb92f9b935ffca1c23cdcd7e

    • SHA256

      d483bccda59ce170c1d569478b4a8082e25a02b8f6d886077eabd98f35b44f6b

    • SHA512

      063d943408cf321c94919e226f2c8fbd7f559d52884de130b10245609957dc6c7a755b13aabdb77927c87e4817ebee601e53d5d3aad2a99f795c123d9af21fa7

    • SSDEEP

      98304:d5VYVCHZrtBwwRFqgdExOlYuI0p56Af7ry:d5VYVAJFvc9ie

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral5behavioral6

    • Target

      tools/SAS/SwissArmySuite.exe

    • Size

      11.0MB

    • MD5

      ea917368bd061374f586064056278dc9

    • SHA1

      5b5005ea8fde431f1d45899c15ce8c3007fde26b

    • SHA256

      2c1e2ca914eb72a46387f0d9b62c484659c3910a49aad97426ec3e0c58cb5c6c

    • SHA512

      001da9569876b07dd3de41e7f3aa4870b58f8d3fa59f8f5e32fec04df4d8f91c95b6834b0ff342eb03d843f4274d334df3135507efad8781e09def4c0f0562e2

    • SSDEEP

      196608:m4ED+kdhp6nLPO+spRlzqxUwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWW:25T0LPO+sp7sIHL7HmBYXrYSaUNk

    Score
    8/10
    upxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral7behavioral8

    • Target

      tools/Xdg/D3Dcompiler_47.dll

    • Size

      4.0MB

    • MD5

      b0ae3aa9dd1ebd60bdf51cb94834cd04

    • SHA1

      ee2f5726ac140fb42d17aba033d678afaf8c39c1

    • SHA256

      e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4

    • SHA512

      756ebf4fa49029d4343d1bdb86ea71b2d49e20ada6370fd7582515455635c73d37ad0dbdeef456a10ab353a12412ba827ca4d70080743c86c3b42fa0a3152aa3

    • SSDEEP

      49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral10behavioral9

    • Target

      tools/Xdg/Qt5Core.dll

    • Size

      6.2MB

    • MD5

      625fbb939568df156c34f0a6a5f2c8ef

    • SHA1

      277bc2b4749e08f7429421a627b248e37ca4398e

    • SHA256

      528b0d47ba2a60d2b857fdb8a5a74cfddeb455d1da5e058701f3d7839925035c

    • SHA512

      0769d18829d5b6fb288156b2034ecb6634d2e53a8a2830f91a77119d2a01da64e57ffdbc355405be2a5cf17bf925c09bff24c2de393fdd751ef788a3ef2e5bdc

    • SSDEEP

      98304:A3GOJAeNjczeOGbw7RifeZJsv6tWKFdu9CtENRnZyAo:A13Qe2Jsv6tWKFdu9CtWho

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral11behavioral12

    • Target

      tools/Xdg/Qt5Gui.dll

    • Size

      6.2MB

    • MD5

      056f15a4545270585122016c8c26c5a0

    • SHA1

      20dee300da1e7c0443db037c54e0bc820824d71b

    • SHA256

      097e21b536a4a90b35c43568ebfd4637c2f545959117f826317d362192699ada

    • SHA512

      5465f0f19daef947213300bbdc6801ec50784c5b7dd273680b5ae5440d4a453c10a37cffd5a2a0a794c39fa47976af858e1e447cd816ecbbe1c74f5ab2ab7410

    • SSDEEP

      98304:W4+0D7NrIK0loDTlzmb0m0VSUs9J4aaFD:H7CDH0VTWraFD

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral13behavioral14

    • Target

      tools/Xdg/Qt5Svg.dll

    • Size

      341KB

    • MD5

      945fd87aac64bd0edecd0e9f794d5ab5

    • SHA1

      64d1acfc22230b86dba2c8dd3b618b844259e3d3

    • SHA256

      0d8602498db78514ee1fd27c86140e551a4cbe074e5fceb282f15a6569992277

    • SHA512

      32ec1d5332d4b3b32f19428f817aa17a26d94a7271e01278e8ca7558981175e647ffcbf619002e92dd17a96d23f2336ba0328f8e113ce55b45de1ceb47ec1f5e

    • SSDEEP

      3072:ZHiT5KzAK4yez4sDn+5cB6WmZrSq0sE8xwCykrQrWIiwhw6WGEFWQTBfnEHo6qG+:wVyU4s65cB+VizAGEWQTB/hGQQ6tBH

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral15behavioral16

    • Target

      tools/Xdg/Qt5Widgets.dll

    • Size

      5.4MB

    • MD5

      78116cccee5022659095a1f4afb6d415

    • SHA1

      1ea956e045f102403a41c3a2b17e190676fe2516

    • SHA256

      da929af39cf0d6e2f3bcdb1b54027661b4bae974d556ad7bf8bb76c8158b3d29

    • SHA512

      b07d10e7dc5a53845b37f0d7100a2296bef7c9d264301c5d143e611ca0e56d9d4d29a6034fd0c62c2d85f94e00209fe18f98714b426a59da4a60770bba066aa9

    • SSDEEP

      49152:ufOuZjl6ROZB51L3VpHPfnd/7JmelJIv1+3LnxFRPackmmEp6ybLpstwZAjhyj3J:m36gZBDLrvxflJIvk7RcetZjED5uWO

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral17behavioral18

    • Target

      tools/Xdg/XDumpGO.exe

    • Size

      16.8MB

    • MD5

      e14f5692745cd84fe023c8cb2f1bb9a5

    • SHA1

      6db5ce468dc78c0b4eb44f21444d1d54f518bc98

    • SHA256

      c5d50504186cc0990a6527b57d2b483991072ed49b47d5286bda513f9d9f3c7e

    • SHA512

      e40867a45dd37b10b582a939194f063a05202b92e7691adb0843baed6df6ea442f9dbf42876c94a65dbd7acb251d9fb51cf1b1347e0ce19198d0890c9bf42c91

    • SSDEEP

      393216:t5yP62cGpN84rcsNNAio2lGG/+2yMDIHL7HmBYXrYSaUN4:8XM7sNpoh/xMa6BYESaQ4

    Score
    8/10
    upxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19behavioral20

    • Target

      tools/Xdg/iconengines/qsvgicon.dll

    • Size

      45KB

    • MD5

      ab6fd39be93f7554db273cde12f91bac

    • SHA1

      765200feedca6991cf2c4aba9ee924bacb9116be

    • SHA256

      ff02d120f090be3d33326a663a8c21bd9d178207e15367614e822ba147721dca

    • SHA512

      5525f7efa1840cd3897f4148f8551d176e8a4a7a3eed4a17230a3f3ffc637c703dfac9bd8fc25273e92bf16f8948d8173814bb64e9fb41d24fe49269ebc1d489

    • SSDEEP

      768:sv4XCkdyOhDiosXTNHqmtbzZ4YmQAmYmKqmQ35DXzi4lmzGK:sAp1ET9LAm4Q5i4AN

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral21behavioral22

    • Target

      tools/Xdg/imageformats/qgif.dll

    • Size

      39KB

    • MD5

      b11749f8761858a81641fce3170d5aaf

    • SHA1

      135655fe8fdb92e7687edeac9672d811f17f9cad

    • SHA256

      52832ac7edc720202373b3b7811ffad571ea732bbfaa7cc0249a61be795cc1d9

    • SHA512

      dee07b86429ac4b19be7b906101b0ccac95ae4c912c884d4922b3b9cada6a2542eb84cd67a71256e756ec38edad0723af55c6e5c4d0cec4dcb1952e5b8835f1d

    • SSDEEP

      768:ZOPWL1Ah3opxwllyL93LfmBqwCblpvJQQiRkhALmzf:ZOO1Ah3oj3qBGblXQQiOhAyT

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral23behavioral24

    • Target

      tools/Xdg/imageformats/qicns.dll

    • Size

      48KB

    • MD5

      58e3b20e2bcc92d8927aa7e3cd206aa9

    • SHA1

      fb5ad84877d215f43af9bfeb14e1d815f5f99755

    • SHA256

      f2daa31679e4ae74899f51bf352125467b564f95c18fce25f07ae76298a6859a

    • SHA512

      9c5830748dd8c4104063d939257498a11648efd1e57ebe8d9d593852d1fea85eee7c2b1252dc9404b14a0aff0b3745d42df914bfd8baca5661a4519d9c39c867

    • SSDEEP

      768:fUufTa3SGf76X9+PsxyxEv0XYOzSJYRbKjOQvcRmWmzqo:fU467jgxv8XYOmJMQvcRmzf

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral25behavioral26

    • Target

      tools/Xdg/imageformats/qico.dll

    • Size

      38KB

    • MD5

      8330a318b2747156dab176c3de15121a

    • SHA1

      2c478d94339f7b852f19b64ff768c5bd2c9bab60

    • SHA256

      cbf94011b5309676accd4e498e9bf580639af62b4c35309bb0c3aed8951ca90c

    • SHA512

      39a2fa386762fb6f0356da7f262ad21774ab4cba0525b70e1be971d042b7593a4ef623eca3868722c8b1e123d1fcdeefd84cff6762dd01befef1fb647a869d28

    • SSDEEP

      768:AsLbQ2DUvSAsAqwodfPr5uaeEcQO4QKjEskmzZ:AsLbQ2DUqAstweNpe6QKgsll

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral27behavioral28

    • Target

      tools/Xdg/imageformats/qjpeg.dll

    • Size

      383KB

    • MD5

      060cfe4c4956a885094a038ab9cc6225

    • SHA1

      c2178ed5255430b313d5a1564148b0d8548a9fe3

    • SHA256

      6a6b7a4960be86d48c446f4066ba5cc9d9b9a2d75cba88883f48a91a63e760c7

    • SHA512

      bf7b234d4c892ff722c7ea8c12079f60daab41206b4c646d28e76b94e708ea66407d87a28cfd53cd2929c166e9de557d0b5a65b1b0d5bcca4b2c06008ef6435d

    • SSDEEP

      6144:Ek1zBFfz/N6MLARlZU/fU32LPjgx1ZVwSLlQI:Ek1zBFgM3rS+m

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral29behavioral30

    • Target

      tools/Xdg/imageformats/qsvg.dll

    • Size

      32KB

    • MD5

      21a3f5eba98004a67d113e4d6c480245

    • SHA1

      e59aedd5f11352137b4da18b51166d537e4a95e6

    • SHA256

      f94f1fd1c6b6e17cd9968469aea37823a1143a8d995e268f95ba529c5b6a0231

    • SHA512

      c57f5c7dd11205dbb7cc90db8a089aa8921ff65ba565d75632d768b682387770e64e411c7190cb75f18ee60576fb53912da9f59cca9a44bae953e6634d654762

    • SSDEEP

      768:60SNI4RG7aUSqDhNIghidZn/jlil2QNTtPTDmz6/:yNIIUSonhw22QNTtPTqO/

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

blankgrabber
Score
10/10

behavioral1

upx
Score
7/10

behavioral2

discoveryexecutionupx
Score
8/10

behavioral3

upx
Score
7/10

behavioral4

discoveryexecutionupx
Score
8/10

behavioral5

Score
1/10

behavioral6

discovery
Score
8/10

behavioral7

upx
Score
7/10

behavioral8

discoveryexecutionupx
Score
8/10

behavioral9

Score
1/10

behavioral10

discovery
Score
8/10

behavioral11

Score
1/10

behavioral12

discovery
Score
8/10

behavioral13

Score
1/10

behavioral14

discovery
Score
8/10

behavioral15

Score
1/10

behavioral16

discovery
Score
8/10

behavioral17

Score
1/10

behavioral18

discovery
Score
8/10

behavioral19

upx
Score
7/10

behavioral20

discoveryexecutionupx
Score
8/10

behavioral21

Score
1/10

behavioral22

discovery
Score
8/10

behavioral23

Score
1/10

behavioral24

discovery
Score
8/10

behavioral25

Score
1/10

behavioral26

discovery
Score
8/10

behavioral27

Score
1/10

behavioral28

discovery
Score
8/10

behavioral29

Score
1/10

behavioral30

discovery
Score
8/10

behavioral31

Score
1/10

behavioral32

Score
1/10