General
- Target bloxflareV8 (1).rar
- Size 1.3MB
- Sample260905-b4ebrs1xft
- SHA256 b4e33d8439a647c60eeeef2b760b60198cc8e3dc433228980264024309aa292d
Malware Config
Targets
-
- Target bloxflareV8/auth-spoof.js
- Size 7KB
- SHA256 ac8c4f521c4b4e1ac5620c11480511c79b5bb5019089d4c7d5b3d53a0c6723ea
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery
Attempt to gather information on host's network.
-
- Target bloxflareV8/background.js
- Size 812B
- SHA256 2774f021198673ac93b3d6b3380b16f54e2b41dca77e1fe13b4a4d46b94bcbbb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bloxflareV8/bridge.js
- Size 4KB
- SHA256 2c9784db3aa2c98c998ffc67351099c845ce1ceed319102331b58b380af96384
Score3/10 -
- Target bloxflareV8/content.js
- Size 2.3MB
- SHA256 ec5fd5770630ce1d758276d281b855ba8c726395be663d53f6f7fd10ea046723
Score3/10 -
- Target bloxflareV8/lib/lil-gui.min.js
- Size 29KB
- SHA256 ef6e0dfc3849a44aba1b62d60b5ad18a0e668238324f880e7cce49e6d7f6658a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bloxflareV8/relay.js
- Size 886B
- SHA256 a89d9a4f93b2cd10269aac5b6bea2a3b54177372a5af63e280cb0da192051497
Score3/10 -
- Target bloxflareV8/rolimons-spoof.js
- Size 305KB
- SHA256 11a57e77beb7d5e28664ebb0cbfae49149b475040b1722da40633baa081373fc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
2Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1