Extracted

Extracted

Extracted

Extracted

• • Target
    BLTools V 3.0.1 PRO.zip
  • Size 72.4MB
  • SHA256 e79cb1af0eef3db7af847cca0bb13cce74b4ba2868897d5f143ab73e62adea82
  • MD5 5de31be3519d67764515c88ff71bf562
  • SHA1 0bda0620f85c124408c5bdaf1d524e31ab6f4354
  • SHA512 f5ff8e9aefc66e7f3e1548c2af5e1f5f726190efcdf369dd156d89575a3bcd4cb0726d96c4851600882ee67b27b264eb51d50502b92a287333a4a3339a41da46
  • SSDEEP 1572864:UJk6ApNOFS7pSZcJx648wo5t9lEItOGd7hu+FhzHVU:UZKUc7EZQJ8wo5bSI8T+Fhz1U
  • TLSH
    T142F733CCC4B89445313F0E7FE39272D4B15B494A1DA9C50B12FAC483B897D89B2676EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    BLTools v3.0.1[PRO].exe
  • Size 10.5MB
  • SHA256 43b714dd95b7765815e16b676de1e2f856ee063d3b935efcae97aecdab4d7d05
  • MD5 3893226661a43a058dd36a1960fd5128
  • SHA1 59214b62066ac8584ca43773acaee37ab23012f1
  • SHA512 7d7fe0abf06711121b106c02c84071dcd5aef7552a6a536568abe692c58f541d1c0528231e6e22ee45b2495570ebeb257d594613245e631724783ed56379bba9
  • SSDEEP 98304:tSUhz8DyfXaKxEf2TQguT4l41PRno+Cev2E9ucwLxrgaP4h:trZ8ePaKx3TQh1PRolfsucWxBP4
  • TLSH
    T176B6374D7B5C41ACC462057240F10A92E7B9EE16A3E85F871BC69C785E221D8AF3DBF4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  282234cryptcrypt2discoveryamadeystealcxtinyloaderloaderpersistenceprivilege_escalationspywarestealertrojanadwareransomware

  • Detects Stealc stealer Version 2

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: XTinyLoader

    XTinyLoader is a modular loader and stealer.

    loaderstealerxtinyloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4