blister | sub_2aaa916d56cf[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
sub_2aaa916d56cf.bin
Size 1.1MB
Sample260524-bvwjpadv9p
SHA256 2aaa916d56cfe95abb65fbc222bfdfa2b16a3ffb6660c1bdc211004302a1aef3
MD5 70f3bf9c31361ebe3e39afc4f05fa160
SHA1 0d1c448b739b18d0e277f2db264b7a6d3d957edd
SHA512 2f1f64c8a20bc753232f7ce912f8dca36db06338df81393b95434dd5e5e60b9fd11aca3f61105eec3eb2c8bd8fd13a31d7bd6713e1e098ea251ae4511cb821f2
SSDEEP 24576:RXwmJ5CbuufVhiKWaoqdk5Tzq47Do4yykwA5BGeudzNd:llJ4budTzqScwAWeuZNd
TLSH
T16B4523151278A38BECC763B0E2124B04D257BC370EF4194E52B5FD6CEF7A9AA9B24513
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader blister

Malware Config

Signatures

Family: BLISTER
BLISTER is a downloader used to deliver other malware families.
loader blister

Detect Blister loader x32 1 IoCs

loader

resource	yara_rule
static1/unpack001/$TEMP/rdpencom_tmp/rdpencom.dll	family_blister_x32

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
sub_2aaa916d56cf.bin
unpack001/$TEMP/rdpencom_tmp/rdpencom.dll

File Explorer

sub_2aaa916d56cf.bin

.exe 1.1MB
$TEMP/rdpencom_tmp/rdpencom.dll

.dll 1.2MB

sub_2aaa916d56cf.bin

IMPHASH bd4aba21cdeddf2da9539bd8879c1921
SHA256 2aaa916d56cfe95abb65fbc222bfdfa2b16a3ffb6660c1bdc211004302a1aef3
MD5 70f3bf9c31361ebe3e39afc4f05fa160
SHA1 0d1c448b739b18d0e277f2db264b7a6d3d957edd
SHA512 2f1f64c8a20bc753232f7ce912f8dca36db06338df81393b95434dd5e5e60b9fd11aca3f61105eec3eb2c8bd8fd13a31d7bd6713e1e098ea251ae4511cb821f2
SSDEEP 24576:RXwmJ5CbuufVhiKWaoqdk5Tzq47Do4yykwA5BGeudzNd:llJ4budTzqScwAWeuZNd
TLSH
T16B4523151278A38BECC763B0E2124B04D257BC370EF4194E52B5FD6CEF7A9AA9B24513
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegDeleteKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

SHFileOperationW ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ord147 SHGetSpecialFolderLocation

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

SystemParametersInfoW LoadCursorW GetWindowLongPtrW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW RegisterClassW DispatchMessageW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongPtrW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW PeekMessageW SetDlgItemTextW GetDlgItemTextW CharPrevW CallWindowProcW MessageBoxIndirectW SetClassLongPtrW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

RemoveDirectoryW WriteFile GetLastError WaitForSingleObject CreateFileW CreateDirectoryW GetUserDefaultUILanguage WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceExW CopyFileW GetWindowsDirectoryW GetVersion ExitProcess GetCurrentProcess GetExitCodeProcess GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW GetTempFileNameW MoveFileExW CreateProcessW GetSystemDirectoryW GetModuleHandleA GetProcAddress lstrcatW SetErrorMode

$TEMP/rdpencom_tmp/rdpencom.dll

IMPHASH 7c9b89444ff48748c211919f9f5ba5de
SHA256 c0f3b27ae4f7db457a86a38244225cca35aa0960eb6a685ed350e99a36c32b61
MD5 a6d49b646ed61b91bcfe9c2170b258cd
SHA1 75c7cdddfbf538f51da8b74cbad11c302206750e
SHA512 18be0707af33a9c4e3b9c57e7c6a3a00b0a249acf606ccb7cc0d968a722637e8bfdc4f7d09da208cd9477ef915fd019ff171df8977c55481093c35d0ccf6a2cc
SSDEEP 24576:mDrIuOfGiDT2XNXWrdyv/z7f0LFrodrs4LK:8OfGKSBWxMfsLFVmK
TLSH
T1DC45F12236E88232D8F371B0577EB6B64AADBA941BB4A1DF124007EF9D317D01E24757
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Detect Blister loader x32

loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

144147

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rdpencom.pdb

msvcrt

_XcptFilter _initterm _amsg_exit ??3@YAXPAX@Z _vsnwprintf _wcsicoll mbstowcs _wcsicmp ??_U@YAPAXI@Z memcpy ??2@YAPAXI@Z realloc _purecall free malloc memset ??_V@YAXPAX@Z

psapi

GetModuleFileNameExW GetModuleBaseNameW EnumProcessModules

kernel32

GetCurrentProcessId TerminateProcess GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetTickCount QueryPerformanceCounter RtlUnwind InterlockedCompareExchange Sleep InterlockedExchange VirtualFree LoadLibraryA HeapAlloc GetProcessHeap HeapFree OpenProcess CreateMutexW SetLastError GlobalAlloc GetVersionExW VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery MultiByteToWideChar lstrlenW lstrcpyW GetLastError InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement CloseHandle LoadLibraryW GetProcAddress GetModuleHandleW lstrcmpiW LeaveCriticalSection EnterCriticalSection HeapDestroy DisableThreadLibraryCalls lstrcpynW GetModuleFileNameW FreeLibrary lstrcatW lstrlenA SizeofResource LoadResource FindResourceW LoadLibraryExW FlushInstructionCache GetCurrentProcess RaiseException GetCurrentThreadId GlobalUnlock GlobalLock UnhandledExceptionFilter

ole32

CreateOleAdviseHolder CreateDataAdviseHolder OleRegGetMiscStatus OleRegGetUserType OleRegEnumVerbs OleSaveToStream WriteClassStm OleLoadFromStream CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree

oleaut32

SysAllocString LoadTypeLi RegisterTypeLi SysStringLen VarUI4FromStr LoadRegTypeLi SysStringByteLen SysAllocStringByteLen VariantClear VariantChangeType SafeArrayDestroy OleCreatePropertyFrame SysAllocStringLen VariantInit VariantCopy VarBstrCmp DispCallFunc SysFreeString

advapi32

CryptGetHashParam TraceMessage GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle RegisterTraceGuidsW UnregisterTraceGuids RegDeleteValueW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW CryptReleaseContext CryptDestroyHash CryptAcquireContextW CryptCreateHash CryptHashData CryptGenRandom

crypt32

CryptBinaryToStringW

user32

GetWindowRect GetClassNameW SetRect PostMessageW MoveWindow DestroyIcon GetWindowThreadProcessId GetKeyState InvalidateRect IsWindow DestroyAcceleratorTable GetParent SetFocus GetFocus IsChild CreateWindowExW GetWindowLongW SetWindowLongW BeginPaint GetClientRect EndPaint IntersectRect EqualRect OffsetRect SetWindowRgn SetWindowPos GetDC ReleaseDC GetClassInfoExW LoadCursorW wsprintfW RegisterClassExW ShowWindow CallWindowProcW DefWindowProcW UnionRect PtInRect CharPrevW SendMessageTimeoutW DestroyWindow CharNextW

gdi32

CloseMetaFile RestoreDC SetWindowExtEx SetWindowOrgEx DeleteMetaFile CreateMetaFileW DeleteDC SetViewportOrgEx SetMapMode LPtoDP CreateRectRgnIndirect CreateDCW GetDeviceCaps SaveDC

ws2_32

closesocket

shell32

SHGetFileInfoW

atl

ord42 ord41

shlwapi

PathFindFileNameW

rdpcore

RDPAPI_CreateInstance

sub_2aaa916d56cf.bin

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$TEMP/rdpencom_tmp/rdpencom.dll

msvcrt

psapi

kernel32

ole32

oleaut32

advapi32

crypt32

user32

gdi32

ws2_32

shell32

atl

shlwapi

rdpcore

generic