a35ce07c606b066a392d99e633c65b683856d659dbc68b1ed16c5f2024e087f1

Sharing

Copy URL Twitter E-mail

General

Target
bloxflareV4.zip
Size 1.7MB
Sample260701-rdnerafy9q
SHA256 a35ce07c606b066a392d99e633c65b683856d659dbc68b1ed16c5f2024e087f1
MD5 0c25235ae46e219af0f6bc5e0fa5b159
SHA1 9d13bc4819a87de7222dc38fa0117780c7755b59
SHA512 7da428f3f5f19b1d67ce329f9e5793e3af015fc00768a762f0713e3854957c95fc5d1aefc5beedd7a621daa47c4ce1d4c2b39aead2aa1b9030682a85b75f2575
SSDEEP 49152:P/Z9A5kSoLXEs2A+zhNgcKSWeXQvZx8qTrVdgokHAjr8mQ/jZA:XGkpoBAYKfeXqZx8qTrVpkarUZA
TLSH
T1DF8533C48BD74771C9808FB17643C297866BC948E06F593E7C281AB052E9C62CFB5A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  bloxflareV4.zip
- Size 1.7MB
- SHA256 a35ce07c606b066a392d99e633c65b683856d659dbc68b1ed16c5f2024e087f1
- MD5 0c25235ae46e219af0f6bc5e0fa5b159
- SHA1 9d13bc4819a87de7222dc38fa0117780c7755b59
- SHA512 7da428f3f5f19b1d67ce329f9e5793e3af015fc00768a762f0713e3854957c95fc5d1aefc5beedd7a621daa47c4ce1d4c2b39aead2aa1b9030682a85b75f2575
- SSDEEP 49152:P/Z9A5kSoLXEs2A+zhNgcKSWeXQvZx8qTrVdgokHAjr8mQ/jZA:XGkpoBAYKfeXqZx8qTrVpkarUZA
- TLSH
  T1DF8533C48BD74771C9808FB17643C297866BC948E06F593E7C281AB052E9C62CFB5A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  bloxflareV4/auth-spoof.js
- Size 7KB
- SHA256 ac8c4f521c4b4e1ac5620c11480511c79b5bb5019089d4c7d5b3d53a0c6723ea
- MD5 6fe7672b627b942fabe840eddd6a83dc
- SHA1 0611b7d994be1212e64c9c4502b57498d4b1d605
- SHA512 63e22e16ba6c57d0e6273abb6f3e240da53aafc72b2fcd739992677f86f2dc820d7dc80b5ef46b657f95be507c6694363f70c4d8699857ea1555a8041af65387
- SSDEEP 192:U5rdmkmZg39z35QQ4KanwShea8DoJ3+oxOL+QuGxu+bGU3:QrdmUxJQvj0A3+QQZhz3
- TLSH
  T197F1104EBCE3B052872370788BEF9504B2B5E513115BCEA4BD9C91603F90469D7B0BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  bloxflareV4/background.js
- Size 812B
- SHA256 2774f021198673ac93b3d6b3380b16f54e2b41dca77e1fe13b4a4d46b94bcbbb
- MD5 8ec3393f4d7ee07475fb45304ac9ce2d
- SHA1 c4c51ed6aedc558050246963ac8e9042244eafa2
- SHA512 f7e39e728420b2b22e1ecf749ba18f38e36d532317c969788c45f6f896956212ba57061dcb968880f5e430b1337cbec0522895702c2587a719b970c6fa8e3965
- TLSH
  T175016DC91CF610621B63B5AAF98E600B362040139A18EA357E8C16510F98A7958B17EA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  bloxflareV4/bridge.js
- Size 4KB
- SHA256 2c9784db3aa2c98c998ffc67351099c845ce1ceed319102331b58b380af96384
- MD5 6d2afe4846ab959730a48d51353a8acf
- SHA1 7a53239958e85543fdb41358012986d75ff916f6
- SHA512 5d1f5125c5c3f2de7647d2a96a1ab15e4c132186ebd70cb1009f28a58c484a1560150de6311f7e6f2ecff7a3122ffe4bb85980988dffc3f012798348f21f1bc1
- SSDEEP 96:/ldjCdA3ZQ32qbxmCdwIwng4TrFwrk2KTv2980:XRK3zXwZ/0
- TLSH
  T131A10388AEF32125E273EADEAB47841A350F95076229D608FA4C43356FD035499D2BAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  bloxflareV4/content.js
- Size 2.3MB
- SHA256 ec5fd5770630ce1d758276d281b855ba8c726395be663d53f6f7fd10ea046723
- MD5 3868d663079c681c0088c48a90122e3c
- SHA1 1effe195aebaa13b09ee30c0caf8bdffb7f66530
- SHA512 98d8595d3158e8bd3a626dcc3a095d3ee4697c9747d4370bfb2958c0b49546036a51bd592609a8c9ac1c53e9fb7b89ba70a71ff2e1bca3531319895306f20ebd
- SSDEEP 49152:twM5cAt+5G2Qn0UGaAnB3IlJ4RyvVl9M/AUpzr:2NH
- TLSH
  T161B5F1423F862CE163079F7F175BB1ECE9070EA9241408CBA2D0FDC9E657616EAD2971
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  bloxflareV4/icon128.png
- Size 4KB
- SHA256 45859925c566c1420e27d27ef988af792d20e5bb67cbf727bd35edfff8abbf71
- MD5 4a48d0be9c86884d33ccdc6b03a23bfc
- SHA1 6728ec2f280bc434d21a773f88a04e70ce6ba1e5
- SHA512 720563e7c47d87fd8c1569f002c841d15396e064ace30b4ef2badc1ad5d4d0e328149d987cd1c37c0265c2d53716dd84c639c0941956e1bc4775c4bd982d1604
- SSDEEP 96:oXM2egukSk5KzJZu9pw7nYVh8rtLeaGUaSiLyeqIzUxcIw5YyNGjB:oXMJFpzJZu9pw7wEJNGe+yeyeb5E
- TLSH
  T109A17D87E8730C681F6737CB893063146598BAC565194B08F092EF45CBF478A6CD68BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  bloxflareV4/icon16.png
- Size 645B
- SHA256 35a0b8d79aefbe099511e16f03caeca00891b55728921e00038e8ddeae2559f9
- MD5 151c30067721c9c058d0cc310865f77f
- SHA1 46fff2827b76b5c256ec254ce29c56d4be416063
- SHA512 058d87275c10a3fa6c95bb10135022bd09f64829b6165476a3b83d52865d93522638f0c0d6105d0fdacaaa09899d1203e7bb46b36f7bcce50d78eb9feab2d60a
- TLSH
  T124F02DF5D1E0926ADA0AA321A0235750B475751FA3BA0499A980C020A948FCC0EFBDB2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  bloxflareV4/icon48.png
- Size 1KB
- SHA256 02a782faa035a3c31dd900bcc5ad8ecd3986eb02c134d2cc56dc068b2b04b04f
- MD5 0b6c37eb45614bd9c93c7bbec0c033dc
- SHA1 09ada20ab9b5a097e11fd1d2a4382564f9302d96
- SHA512 fe6bb8f62f40b165ae4aa198196f84f15703203fa06ca3bc48b0927b717eb45c76c486be4af7b020c0caa018ca77fe0bd9b08ba87ee6abaa77f69ee51c6620bd
- TLSH
  T133310BCBA937EAB3CA830B4555A7046CC574C0564DE3214AD823D304D49FDDC95D4CC6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bloxflareV4/lib/lil-gui.min.js
- Size 29KB
- SHA256 ef6e0dfc3849a44aba1b62d60b5ad18a0e668238324f880e7cce49e6d7f6658a
- MD5 783b2eb3e89f38b814a54365dbff2442
- SHA1 62ef78ed5c8a100360dab84fe3d37da6a54b3c08
- SHA512 ce1c44c0a947982dcf35ae5f8921b6235732743ada0ee3d90d777aef0abfa79924374762afc51435f9e33ac5770358dd1f60c1fcb70a027ad86b3d8bc9059ffc
- SSDEEP 768:xgussTgPV7ZGe1+BszFSFdXSZnNiujMNJ4Ll:FssTIzJi+M2
- TLSH
  T1F2D2C5F32369A13907E5D15521F88A5AB1315198E64202EDB97CDCDEA8CECC13277EBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  bloxflareV4/manifest.json
- Size 1KB
- SHA256 6c5e5aee4d7312fa1a44e7c7ef9789972fe11b413d1c8015dc0a2fcf04ce3949
- MD5 0b35e7944a433109c5a153d80e2f2654
- SHA1 6a98a20910969179b788408f91336006ee06bd2d
- SHA512 19c638409868b3e292cde4009cc658b0c790f67c4ce49caece4dbb0d7d0ee42f8820aed5e022d974ad0d880916c417f7cec7a9d6f4544d4471b9e8420eafbb22
- TLSH
  T1EE3137B7C7204C2217D46AA074BA6716BA420A8F9DC1BDC4F69C602E4F6856E15B07A9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  bloxflareV4/relay.js
- Size 886B
- SHA256 a89d9a4f93b2cd10269aac5b6bea2a3b54177372a5af63e280cb0da192051497
- MD5 dfd171b18a82b64ad91d2bc42c26d1ba
- SHA1 8b31b708058d3f348302bbdb21be1d126238f448
- SHA512 0db17cccedbfad2dc30aff40683a27690090cdea5ed9d0faec7c0522d908ec083f50f8d2a39a76c9aa9472d4a1df2a8509df83352e728a6745f2a59b73859f60
- TLSH
  T191113A4C95E630FD882260A51F5F3803335F728221A8D944FF5CC1B80F104A3A9B16C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  bloxflareV4/rolimons-spoof.js
- Size 305KB
- SHA256 11a57e77beb7d5e28664ebb0cbfae49149b475040b1722da40633baa081373fc
- MD5 db8cc09d02de2bad9a80d5f3de444f9e
- SHA1 29b59d3386ce6dd384d62d3ae683f429800fef62
- SHA512 c2ff34add4aec5e80b8b4089b009485d218be943ada5a237a2a15f8d2fb8875c448f43ccc80f145d92e64787ceb6e0df89ca5b02497945217ae607e1b1b1073c
- SSDEEP 6144:rQmzrIaAREN/n8j11kP/eDpCP9wyOHXD8fJZJQjmT8vBK9VSYmDr:rLDP8j11kP/elCP+y8yZ8mTIw9Ver
- TLSH
  T1C464F8007BC47481138B7BB6371B71E5E5BA0AEE35C44C4BF115FD907A62216EAEAE70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24