BlueberrySetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BlueberrySetup.exe
Size 3.5MB
Sample260802-hknvesee95
SHA256 e7406d9067436185cc18d08e2eee2cd24079a6dd887162cf3f1e32bca0b8d83e
MD5 49f4f8f408494d7c49eb5e1aa39eee8e
SHA1 e7ecff77d48982ac335ff8339a488bdb248ce9a4
SHA512 4c2fe008b03e62c9168cac5e9ba932107fa890021cf70ab9ad09ee2d28311235bc93d693e5e3c6eea1f8f13edfcb3d27e0476f95676d3c1c04c92aa2d452db65
SSDEEP 98304:rDJD4m3LVh3/U9w5gUENDTXHVqXYeGRSKb4aSGt:rND4KVh3R5gUEd7sFTcft
TLSH
T1DF0633591B3D4831C01748B89FA5CA8EDD6779C488F4AE6B0F1ED69A7F82681EF1DD00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/dlls/d3d12.dll
unpack001/dlls/gamelaunchstub.exe

File Explorer

BlueberrySetup.exe

.exe 3.5MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
Blueberry Client.exe

.exe 10.6MB
dlls/d3d12.dll

.dll 102KB
dlls/gamelaunchstub.exe

.exe 101KB

BlueberrySetup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 e7406d9067436185cc18d08e2eee2cd24079a6dd887162cf3f1e32bca0b8d83e
MD5 49f4f8f408494d7c49eb5e1aa39eee8e
SHA1 e7ecff77d48982ac335ff8339a488bdb248ce9a4
SHA512 4c2fe008b03e62c9168cac5e9ba932107fa890021cf70ab9ad09ee2d28311235bc93d693e5e3c6eea1f8f13edfcb3d27e0476f95676d3c1c04c92aa2d452db65
SSDEEP 98304:rDJD4m3LVh3/U9w5gUENDTXHVqXYeGRSKb4aSGt:rND4KVh3R5gUEd7sFTcft
TLSH
T1DF0633591B3D4831C01748B89FA5CA8EDD6779C488F4AE6B0F1ED69A7F82681EF1DD00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

a3:f0:df:99:63:f8:3d:15:23:8b:50:a5:8e:de:2e:45:11:46:72:0a:62:24:3d:47:e8:8e:e7:e4:79:21:ad:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Mystic Systems LLC,O=Mystic Systems LLC,L=Sheridan,ST=Wyoming,C=US

Chains

Aug 2, 2026

CN=Mystic Systems LLC,O=Mystic Systems LLC,L=Sheridan,ST=Wyoming,C=US

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

64:33:51:d3:c7:38:9f:08

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 24, 2016 - Jun 24, 2031

Subject

CN=Mystic Systems LLC,O=Mystic Systems LLC,L=Sheridan,ST=Wyoming,C=US

Serial Number

0d:b4:8c:7c:3e:ac:84:e3:cb:4b:69:d9:dc:fd:ea:8d

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 21, 2026 - Jul 21, 2027

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

Blueberry Client.exe

IMPHASH bf09a873764a5708ceccee86a4214eec
SHA256 714e971f84e8444db6a31b7bf5dfa52c81910d7347735b2680d65027fab4f906
MD5 ad775f447dafdd65b0bd94dbbb207006
SHA1 89aeb0281062cb957f65fe5d94eea414f2dd67ad
SHA512 b40b8ac426fdfa170da881e26a633da6b99dffbd9f505e454b8613de05e6b8e30c86d9216a4886bcee6f0c57fad206765bd68aad529dacf346afbc41926187a7
SSDEEP 98304:hnmC74S2T4+sCUDCCxewHxArxDK3qrlBbW9FbDQdMtn+3Oc0wAEVgBZa:h+OblHx0BbENGM9wWe
TLSH
T182B629057F8A59A9C0CDCC70C34B8BA74E1230DB1936F9BF89D606192F6E6B55F19328
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1e:31:c7:fe:cf:c6:b0:73:1a:dd:68:91:f7:b5:e8:f0:26:51:ef:bd:e5:4f:fc:77:44:96:6c:e2:a4:68:29:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Mystic Systems LLC,O=Mystic Systems LLC,L=Sheridan,ST=Wyoming,C=US

Chains

Aug 2, 2026

CN=Mystic Systems LLC,O=Mystic Systems LLC,L=Sheridan,ST=Wyoming,C=US

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

64:33:51:d3:c7:38:9f:08

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 24, 2016 - Jun 24, 2031

Subject

CN=Mystic Systems LLC,O=Mystic Systems LLC,L=Sheridan,ST=Wyoming,C=US

Serial Number

0d:b4:8c:7c:3e:ac:84:e3:cb:4b:69:d9:dc:fd:ea:8d

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 21, 2026 - Jul 21, 2027

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

6716384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

app.pdb

bcryptprimitives

ProcessPrng

kernel32

SetLastError FlsGetValue FlsAlloc FlsSetValue FlsFree EncodePointer SwitchToThread HeapReAlloc GetCurrentThread SetThreadStackGuarantee Sleep GetProcAddress GetModuleHandleA InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx LoadLibraryExA FormatMessageW SystemTimeToFileTime ReleaseMutex RaiseException SystemTimeToTzSpecificLocalTime LoadLibraryA GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW CreateMutexW LoadLibraryW CreateFileW RtlPcToFileHeader GetModuleHandleW GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable SetFileCompletionNotificationModes AcquireSRWLockExclusive ReleaseSRWLockExclusive RtlCaptureContext SetEnvironmentVariableW lstrlenW GetUserDefaultUILanguage LCIDToLocaleName RemoveDirectoryW FindClose TerminateProcess RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId CreateMutexA WideCharToMultiByte MultiByteToWideChar GetLastError SleepEx SetHandleInformation CreateThread SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CreateEventW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW DeleteFileW GetFinalPathNameByHandleW CopyFileExW MoveFileExW CreateSymbolicLinkW CreateWaitableTimerExW SetWaitableTimer FindNextFileW AddVectoredExceptionHandler InitializeCriticalSectionEx HeapAlloc DeviceIoControl CancelIo WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CancelIoEx WriteFile DeleteCriticalSection CreateIoCompletionPort ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx CloseHandle GetOverlappedResult GetFullPathNameW HeapFree WaitForSingleObject GetExitCodeProcess LocalFree GetProcessHeap FreeLibrary GetCurrentThreadId LoadLibraryExW OutputDebugStringW OutputDebugStringA UnregisterWaitEx SetFilePointerEx WaitForMultipleObjects FlushFileBuffers RtlVirtualUnwind GetSystemInfo RegisterWaitForSingleObject

advapi32

RegQueryValueExW RegGetValueW RegOpenKeyExW RegCloseKey SystemFunction036 EventRegister EventWriteTransfer EventSetInformation EventUnregister

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile RtlGetVersion NtReadFile NtOpenFile NtCreateFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ole32

CoTaskMemFree CoUninitialize OleInitialize RegisterDragDrop CoCreateFreeThreadedMarshaler CoTaskMemAlloc RevokeDragDrop CoInitialize CoInitializeEx CoCreateInstance

shell32

SHAppBarMessage SHGetKnownFolderPath SHCreateItemFromParsingName SHOpenFolderAndSelectItems ILFree DragFinish DragQueryFileW ILCreateFromPathW ShellExecuteExW ShellExecuteW

user32

SetWindowTextW SetFocus GetWindow GetWindowTextLengthW RegisterRawInputDevices SetWindowDisplayAffinity GetWindowTextW ReleaseCapture IsWindowVisible GetKeyState GetKeyboardLayout MapVirtualKeyExW GetParent SetWindowRgn InvalidateRect FindWindowExW SetPropW UpdateWindow FlashWindowEx LoadCursorW CloseTouchInputHandle GetTouchInputInfo MonitorFromRect SetCapture GetClipCursor GetKeyboardState GetSystemMetrics ClipCursor SetCursor GetWindowPlacement GetMonitorInfoW SetWindowPlacement ShowCursor ScreenToClient TrackMouseEvent ChangeDisplaySettingsExW SystemParametersInfoW AdjustWindowRectEx FindWindowW RegisterClassExW CreateWindowExW SetWindowLongPtrW SendMessageW DefWindowProcW GetWindowLongPtrW IsWindowEnabled GetMenu GetWindowLongW MonitorFromPoint GetSystemMenu InvalidateRgn RegisterWindowMessageA GetAsyncKeyState SetParent EnableWindow IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect RegisterTouchWindow GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo SystemParametersInfoA ShowWindow PostQuitMessage GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem EnableMenuItem DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx ReleaseDC GetDC VkKeyScanW SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu IsWindow IsIconic EnumDisplayMonitors TranslateAcceleratorW GetMenuItemInfoW MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx DispatchMessageW GetMessageW PeekMessageW PostThreadMessageW SetWindowLongW PostMessageW SetCursorPos GetForegroundWindow EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos DestroyWindow RedrawWindow AdjustWindowRect ToUnicodeEx

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass TaskDialogIndirect

shlwapi

SHCreateMemStream

crypt32

CertFreeCertificateContext CryptProtectData CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain CertEnumCertificatesInStore CertDuplicateCertificateContext CertAddCertificateContextToStore CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertDuplicateCertificateChain CertCloseStore CertSetCertificateContextProperty CryptUnprotectData CertAddEncodedCertificateToStore CertDuplicateStore CertOpenStore

bcrypt

BCryptGenRandom

gdi32

BitBlt CreateRectRgn CombineRgn GetDeviceCaps SetTextColor CreateCompatibleDC SetBkMode CreateDIBSection DeleteObject SelectObject CreateSolidBrush DeleteDC

ws2_32

shutdown send recv freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt WSASend connect getsockopt getsockname WSAGetLastError getpeername closesocket WSAIoctl ioctlsocket WSASocketW bind

secur32

ApplyControlToken AcquireCredentialsHandleA InitializeSecurityContextW FreeContextBuffer DeleteSecurityContext FreeCredentialsHandle DecryptMessage QueryContextAttributesW EncryptMessage AcceptSecurityContext

api-ms-win-crt-string-l1-1-0

strlen strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-math-l1-1-0

pow __setusermatherr trunc floor roundf round

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit _crt_atexit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type terminate _register_onexit_function _initialize_onexit_table abort _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _callnewh calloc malloc _set_new_mode

dlls/d3d12.dll

IMPHASH 74db35d0bb05734efa3cd4035719be5d
SHA256 febc1033ebaf5b017f948a88de8d29ef694707972d8a7ad943beaf5eab26fe25
MD5 f975102a83ec1c8f0fe0a21743b46479
SHA1 fca1959265fc4ba873c4219bdfad3c19066d1457
SHA512 4707045a51ad5c455479e3b726bf99c16726c86580a3472f32ae79d002c2ac7d14626ba9a471bf696b933369f25ea75af20dbe1cafe83e30ad5a42725263ec71
SSDEEP 3072:fVmKY5YdWkFZZwdiiA7Fo/rg4aQMLy/Xzn4Qt32Dz:NmKY58ZZwUiUaq
TLSH
T179A3495B63F640BBE177827884630A49E776B85107609FEF03A4025A2F277D19D3EF62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW WriteConsoleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dlls/gamelaunchstub.exe

IMPHASH 12b00357ba2f6b746396ccd7dc0cc31d
SHA256 a830ac6ae8e32d18e9041330de8c36bdd11e1087236ee3d82667b8d1d2ac8d55
MD5 1600950419952484ffc8fd867e661efd
SHA1 aa8a9beab2dc4232ac781d3c19c8f3cb9cc06c4b
SHA512 22df0cb03c1a3c2579bb9c4bcaa3ffcfc68a26aedc2470c9b5244ed9a323eb166acffac69414ad370e3c3f0a4a9bbf956187323c9b081f08e356629cd76043ee
SSDEEP 1536:xY4heMqYE9R4Nrn+8H4kn8bFe7HuYeR3KC5KZ8xsWydc9dlD7FT9zvg:Wo5qYi865kn8gqR3TAZ7Up7x9zvg
TLSH
T194A33B5BA3E531F8E1B7863D84A24A45DB76B8310B619FEF03B4425A1F236D18D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle CreateProcessW GetModuleFileNameW lstrcpynW lstrcatW WriteConsoleW CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

MessageBoxW

Name

.text

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BlueberrySetup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

Blueberry Client.exe

bcryptprimitives

kernel32

advapi32

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

ole32

shell32

user32

dwmapi

comctl32

shlwapi

crypt32

bcrypt

gdi32

ws2_32

secur32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

dlls/d3d12.dll

kernel32

generic

dlls/gamelaunchstub.exe

kernel32

user32

generic