General
- Target BloxBot-Setup-0.10.0.exe
- Size 96.1MB
- Sample260830-2yn7wsbj5z
- SHA256 5c17aa1a77ed2da10076ffbd61f9d525c2f4d538ec4b2924e37a3e7e2b280a55
Malware Config
Targets
-
- Target BloxBot-Setup-0.10.0.exe
- Size 96.1MB
- SHA256 5c17aa1a77ed2da10076ffbd61f9d525c2f4d538ec4b2924e37a3e7e2b280a55
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target BloxBot.exe
- Size 215.0MB
- SHA256 a857fbb1fe67d043c92722fcd3952ee0c0e272266a33bfe806e374d5ed7937a9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target LICENSES.chromium.html
- Size 19.4MB
- SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
Score1/10 -
- Target dxcompiler.dll
- Size 24.4MB
- SHA256 a26f279fb9e49fef94d60710a8371f5f9cbeac73d92d6ad072a664c9c4442213
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 eaeb2203f72d89615ffbf6a38bb96860cc78a9095126b790e36fc91c8f1fef3d
Score1/10 -
- Target libEGL.dll
- Size 463KB
- SHA256 0c2960b094a77dba406e1401c6dcdc35245f218c7b910062d51cfac0f4898830
Score1/10 -
- Target libGLESv2.dll
- Size 7.7MB
- SHA256 d254bf59b7e56730e56f58061ba83f0e75c0b393c4879a64560cc867d1f8e7f3
Score1/10 -
- Target resources/app.asar
- Size 4.8MB
- SHA256 129d3071d4113293df303bf13131416604a82c0fa831f0dcdc291aa9bb817312
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vk_swiftshader.dll
- Size 5.2MB
- SHA256 0fc94c88bf7cedaf866da5c959a1c52fd1b8ddb2d72185bd8fa2843fe9112e7c
Score1/10 -
- Target vulkan-1.dll
- Size 908KB
- SHA256 1843299ee154fc50d6d11ff5918742852d70467385e10b7a1019ea3358f3085a
Score1/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10 -
- Target $R0/Uninstall BloxBot.exe
- Size 141KB
- SHA256 3a286bc256386bbf8b0c93b86d8af49149250121641bc7ec40e0d84e827e5b28
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Windows Command Shell
1