e015e651252869719eda08dcc07855c95b0f17021d7b1b5baf67e32e2d2b333d

Sharing

Copy URL Twitter E-mail

General

Target
Bluebook Setup 0.9.688.exe
Size 111.7MB
Sample260805-v4px2ssbnb
SHA256 e015e651252869719eda08dcc07855c95b0f17021d7b1b5baf67e32e2d2b333d
MD5 d0c48e42128691e622a4d682d9579c33
SHA1 dddd4e05f92a541c9e97dcfe4dcc68297a4ce879
SHA512 46853899a1fb4ea56080275795fa25f08d3fbcd90dedf6d1615c21f26ec4d999c1ddd187bcb348a4964c8a3c8708744b5a5d6abb4781051f9fd59dbb5527fe8c
SSDEEP 3145728:ojj9NNNRhYxZ3Ykln1DVYneasvANqD7YXIL5fmp5CLROfny6RU03G:q9NbRhYxZ3YIDVYneFANqD7KIpmpzfnu
TLSH
T1D44833B9CB6457FDD90367BB51A23D3F096D2CCB763011E3A7D84C6029EE4EA48E0646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Bluebook Setup 0.9.688.exe
- Size 111.7MB
- SHA256 e015e651252869719eda08dcc07855c95b0f17021d7b1b5baf67e32e2d2b333d
- MD5 d0c48e42128691e622a4d682d9579c33
- SHA1 dddd4e05f92a541c9e97dcfe4dcc68297a4ce879
- SHA512 46853899a1fb4ea56080275795fa25f08d3fbcd90dedf6d1615c21f26ec4d999c1ddd187bcb348a4964c8a3c8708744b5a5d6abb4781051f9fd59dbb5527fe8c
- SSDEEP 3145728:ojj9NNNRhYxZ3Ykln1DVYneasvANqD7YXIL5fmp5CLROfny6RU03G:q9NbRhYxZ3YIDVYneFANqD7KIpmpzfnu
- TLSH
  T1D44833B9CB6457FDD90367BB51A23D3F096D2CCB763011E3A7D84C6029EE4EA48E0646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Bluebook.exe
- Size 182.6MB
- SHA256 efe96b695f835e1147bbb765d84b8a9156af87575ded7f4ba28a19b46ab7a7c1
- MD5 5ed1688084d5736d4b07fe28c24b9061
- SHA1 df0f0e70ce06f2853f7ff8525e88abef851bea88
- SHA512 4d75454b9f916db039e7054c279b6028ae21b5c82ebac26018e0ca575774a4fdb9ca6a4159e24a2cc6be18ff6beaeff0ffac291726fb7e6332a5382617e1ca43
- SSDEEP 1572864:tOdcCRYhsoEuCUycBQdhG8OZHQuajYAROFFy3Oo8cEFoN4ZIjApHjfnu/zPTAUx5:MuQ0ha8e98cEGaZDfw5TDO1in2RfvC
- TLSH
  T10298AE02B451907CD48233F3791DB73F692442538B294ACBFAB86CD86BE99D1727B346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.0MB
- SHA256 e9ebe24981d2b9f8e8cdd9dbc5df6abdbbb62d5fc51437d83e94e307e9d9c804
- MD5 3524d130405f0d87765ad887f2cb03ad
- SHA1 34ec4f9acdbc24e897caf03da96d8623a053defb
- SHA512 ffc397152449d7c608b583c85e05ac004e087499da1be379d7b8b5cb6ce65e65105a2ea70abf085aa81acacf35fbd4e3aafd1d253322f39f57c94d9bdb10cdc2
- SSDEEP 49152:wXlJ9pAeB6roiiqkhNA0UNoChHZYe/ik/N2q0H01PdbHhu4UxwtYeQ2jSTSdrYWT:wXT9X1GiEimZhuoYkWSdrYWpNF7n0u
- TLSH
  T15C169E21F6428072C8CA15F076EE776A947C9B301B3444C752D0ADA9ED711D3AF3AB9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 1ee94020e9a1767bbda9a40f1e90b36432bd4af02d0898d7396f07713734a9f5
- MD5 a0e45575acd1588d716e0e6f8d1520a3
- SHA1 ec36319753659a7addc089b572d6dcbe384ccc4c
- SHA512 f79542ea3beb419a40660630b40dd59d7d50613e4cccfb88a667604f6a96064eb2d593e50877d870fe6a5173dfd167ec8cf447113d7db141535ff80498d5a854
- SSDEEP 49152:RVnB8SJFDugakUcGGPT3vrg3ab737l1C4:RVnB8IDfakUNGLxb737lY4
- TLSH
  T174D5AE52255076EED49F3631314EB36F5A382B64C7118CE797842DACABACAC059FB313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  libEGL.dll
- Size 427KB
- SHA256 268d2a2449bfc083c95adc8fd9e36d441ea3549ba9ffcce405c70077f2008283
- MD5 f517dc2b41dd3a8d736c74552b60081c
- SHA1 be76ef97a166875157f8943bde38acfbb0ec2191
- SHA512 0d44f757107e9cd3ebb1787df068ca2b9cde8ba1e471cefed26baa3f99edc48a05d4bdabe396fba4fe27921e7282e2d372c720fa766dada6550aead84dc6e2c4
- SSDEEP 6144:FEyBCNhO92ZU/4is/meI88fBjMJcfO8JqhxcGd71rOZXA2Lu4+UznCpihRB640/H:FEyBWQYU/4i2mRZO8AQZrj7Z6f1
- TLSH
  T13B947E017584D0FDC8EF20B12674E379DA7DF8501B2648D7A3884DB7ABF06C2563976A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  libGLESv2.dll
- Size 7.0MB
- SHA256 d0df29ef6ff46ce74e62ab85a161571e36f68443943194a33650532ddadfec20
- MD5 c179635baad5f076352d07ede062759c
- SHA1 4da021568cfbdf37713f2a41f1b47ac0c2080e6a
- SHA512 44433dc7686ccabf6d944638e23093bd3cefdd969a2ffa1f606659bb5ac43e43a40e932501e1d99b3af0766345f8a42570d3c83f2536c36c8f5a99474f349c6d
- SSDEEP 196608:OIqYo3xzBh+//I6fT26R1Aza2i12bApy9e6gb3f:uj3hm//I6B12bh9e6gb3
- TLSH
  T135769E0269419074C81B31B13409677EDE6547612B2887CBFECC6EA0ABF45D36A7B36F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  vk_swiftshader.dll
- Size 4.8MB
- SHA256 666d381af019f655e3dd26c6aa1fbee4b6c1a42cd3432ee906d7c836be5870d8
- MD5 e920ffb0ee01abc8f7625c070a92813d
- SHA1 923f5d14f79db171b6d74745c49eb084a646970a
- SHA512 53df9b1466ee4597a9c5f8bd138e4fb28a75639bf39e797b641d2899904852223c91602de6f5c05cdd9b09da588b2559684e655b22e0c528a83a7aa8eab0309c
- SSDEEP 98304:F5yw8+TgVo73MN5c7KP+vVSLNZgs9FwK3tk5OoimHV0xm71i:7yJo73M3aKoiw0xms
- TLSH
  T142368D027150A0B4E40620B53518B779DE74CB307B524ACBEA90ADDCAFB46E2667F35F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  vulkan-1.dll
- Size 851KB
- SHA256 6b942e989871725df7a5a6fed67f9a1a7ee503cc34c2d81c2a3b950c87b039df
- MD5 60910e60e3da96d7d5bc47915f0467fd
- SHA1 3b2bd3e67df6ca3b6f32f7d49d1daf4e230e3c88
- SHA512 49a166533d4390eaaf51b8676a2c47b5f01a24b81be88acf7f6953e8e9911420c82dccc27c331367e0275c3de9558e4318fa1d2b0d5ee27be7c6d7542fb10ff6
- SSDEEP 24576:UiBU1XPaSt0rAqs3gJUT6Z5WzcxDYsHkDE6g3P0zAk76oOHt3p:dhlrrs30C6Z5WzcxDYsHkDE6g3P0zAkY
- TLSH
  T1F5056C1F7A4880B5DB2F3038B571B1B607799492637448CB2A5CAF90BFA85D0337D76A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  $R0/Uninstall Bluebook.exe
- Size 141KB
- SHA256 6a8bab67b8cdeeeb502ec1d8962188e4908340dc5b91e517185d8088f8aa08f7
- MD5 cfbe6ebcd5ca64e3ab8a6079d1303927
- SHA1 894b1caea9bd7e3d178530a4edf4334f55e3a1ec
- SHA512 a58f5edab89fa9027e398a397d3e871e477f0b30f59602f70a71b92c35cef4fe16478c960c5efc0870c8680e2a7bbd3e58466811eae4a519cd9fedcb9c047948
- SSDEEP 3072:7n77v00hEoDEtau18qY/WC3HaH2tvhOEA1RJCir86SrSrv6Ia3K:7740Ie//3Hs2t0EyL+ya
- TLSH
  T18BE3F111A7E0C857E8E74F3166F893EB2EB1F10524648F833784671D7A52B82EE5E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral24 behavioral25
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads ssh keys stored on the system

Network Service Discovery

Checks computer location settings

Reads ssh keys stored on the system

Network Service Discovery

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32