General
- Target BlueStacksInstaller_5.22.260.1025_native_7511c73a33d3afad1eb673495a2f3976_MzsxNSwwOzUsNTsxNQ==.exe
- Size 931KB
- Sample260826-llws7sbm9s
- SHA256 f67c0a0e19d9d67ff89a46f2f75a98c675cd3199ed7cfcd6438bd450baccc034
- MD5 697df8a7947c1eedb64c43f57850448c
- SHA1 bfa07fae4845473e4c5aa7d1ab1c22971f466675
- SHA512 8358485589be0244a833d4260fdbf7dd1d6a69662037b814a39c4c41919bdf691c73154f0e1faf21d2135ebf5966a3fb367c8909481cc06647c37069d5a074aa
- SSDEEP 24576:DivtCXWeGKH/NGzTukzl7AMe98fN5Lrlde:GtCXWP6/m3mML1de
- TLSH T1A415CE9C20A1C077C9670FF284E5DF672115F9913B23A52EE2942E997A30E925BF7133
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
BlueStacksInstaller_5.22.260.1025_native_7511c73a33d3afad1eb673495a2f3976_MzsxNSwwOzUsNTsxNQ==.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
BlueStacksInstaller_5.22.260.1025_native_7511c73a33d3afad1eb673495a2f3976_MzsxNSwwOzUsNTsxNQ==.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target BlueStacksInstaller_5.22.260.1025_native_7511c73a33d3afad1eb673495a2f3976_MzsxNSwwOzUsNTsxNQ==.exe
- Size 931KB
- SHA256 f67c0a0e19d9d67ff89a46f2f75a98c675cd3199ed7cfcd6438bd450baccc034
- MD5 697df8a7947c1eedb64c43f57850448c
- SHA1 bfa07fae4845473e4c5aa7d1ab1c22971f466675
- SHA512 8358485589be0244a833d4260fdbf7dd1d6a69662037b814a39c4c41919bdf691c73154f0e1faf21d2135ebf5966a3fb367c8909481cc06647c37069d5a074aa
- SSDEEP 24576:DivtCXWeGKH/NGzTukzl7AMe98fN5Lrlde:GtCXWP6/m3mML1de
- TLSH T1A415CE9C20A1C077C9670FF284E5DF672115F9913B23A52EE2942E997A30E925BF7133
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1