hxxps://cloud[.]bluestacks[.]com/api/getdownloadnow?platform=win&win_version=11&mac_version=&client_uuid=a6eaafa8-2b5b-4603-bce9-f730607afcb1&app_pkg=bs10-en&platform_cloud=&preferred_lang=en&utm_source=&utm_medium=&gaCookie=&gclid=&clickid=&msclkid=&affiliateId=&offerId=&transaction_id=&aff_sub=&referrer=&first_landing_page=&download_page_referrer=https%3A%2F%2Fwww[.]bluestacks[.]com%2Fdownload[.]html&utm_campaign=download-en&user_id=&exit_utm_campaign=bsx-install-button-download-page-en&incompatible=false&bluestacks_version=bs5&device_memory=16&device_cpu_cores=7&extra_data=%7B%22deviceDetails%22%3A%22windows%22%2C%22renderer%22%3A%22ANGLE%20(NVIDIA%2C%20NVIDIA%20GeForce%20RTX%204060%20Ti%20(0x00002803)%20Direct3D11%20vs_5_0%20ps_5_0%2C%20D3D11)%22%7D

General

Target
https://cloud.bluestacks.com/api/getdownloadnow?platform=win&win_version=11&mac_version=&client_uuid=a6eaafa8-2b5b-4603-bce9-f730607afcb1&app_pkg=bs10-en&platform_cloud=&preferred_lang=en&utm_source=&utm_medium=&gaCookie=&gclid=&clickid=&msclkid=&affiliateId=&offerId=&transaction_id=&aff_sub=&referrer=&first_landing_page=&download_page_referrer=https%3A%2F%2Fwww.bluestacks.com%2Fdownload.html&utm_campaign=download-en&user_id=&exit_utm_campaign=bsx-install-button-download-page-en&incompatible=false&bluestacks_version=bs5&device_memory=16&device_cpu_cores=7&extra_data=%7B%22deviceDetails%22%3A%22windows%22%2C%22renderer%22%3A%22ANGLE%20(NVIDIA%2C%20NVIDIA%20GeForce%20RTX%204060%20Ti%20(0x00002803)%20Direct3D11%20vs_5_0%20ps_5_0%2C%20D3D11)%22%7D
Sample260802-sn9lea11b1

Score

8^/10

Malware Config

Targets

- Target
  https://cloud.bluestacks.com/api/getdownloadnow?platform=win&win_version=11&mac_version=&client_uuid=a6eaafa8-2b5b-4603-bce9-f730607afcb1&app_pkg=bs10-en&platform_cloud=&preferred_lang=en&utm_source=&utm_medium=&gaCookie=&gclid=&clickid=&msclkid=&affiliateId=&offerId=&transaction_id=&aff_sub=&referrer=&first_landing_page=&download_page_referrer=https%3A%2F%2Fwww.bluestacks.com%2Fdownload.html&utm_campaign=download-en&user_id=&exit_utm_campaign=bsx-install-button-download-page-en&incompatible=false&bluestacks_version=bs5&device_memory=16&device_cpu_cores=7&extra_data=%7B%22deviceDetails%22%3A%22windows%22%2C%22renderer%22%3A%22ANGLE%20(NVIDIA%2C%20NVIDIA%20GeForce%20RTX%204060%20Ti%20(0x00002803)%20Direct3D11%20vs_5_0%20ps_5_0%2C%20D3D11)%22%7D
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1