BlazeTriggerbot_root_bypass[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BlazeTriggerbot_root_bypass.exe
Size 633KB
Sample260910-1mappahk5z
SHA256 85def5f2a3fbca9d1a6e6f196e128d802c61004dd63a2317814549cc8e21e7db
MD5 11576990e500edd1326d636ed043b350
SHA1 b10b669a71315b411386eb99a996d19d34708878
SHA512 964d7a74dd05137a895538084754798b52b459d5f9be32b0b221226b8c60de4938d2888f66a51b9334ed9dbb0da5dfbd634762817556baae47335f4c3ef5d151
SSDEEP 6144:WYBhqaBX2vxRkWPcMx/Fq4hv8lHVlF/qKHf+5OuRaxy5xJFyg1beXj6K6Amoau8G:WBMqHxLB8lVlQK/+l+F6DGRg8O
TLSH
T1A5D4BF2DBA2ACF76C3A790BD4E93CD02B2F17A4EB351BBC79E1197B419115C48273249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BlazeTriggerbot_root_bypass.exe

File Explorer

BlazeTriggerbot_root_bypass.exe

.exe 633KB

BlazeTriggerbot_root_bypass.exe

IMPHASH ad696e00ac86cccd3e6b8b6e6ef109fb
SHA256 85def5f2a3fbca9d1a6e6f196e128d802c61004dd63a2317814549cc8e21e7db
MD5 11576990e500edd1326d636ed043b350
SHA1 b10b669a71315b411386eb99a996d19d34708878
SHA512 964d7a74dd05137a895538084754798b52b459d5f9be32b0b221226b8c60de4938d2888f66a51b9334ed9dbb0da5dfbd634762817556baae47335f4c3ef5d151
SSDEEP 6144:WYBhqaBX2vxRkWPcMx/Fq4hv8lHVlF/qKHf+5OuRaxy5xJFyg1beXj6K6Amoau8G:WBMqHxLB8lVlQK/+l+F6DGRg8O
TLSH
T1A5D4BF2DBA2ACF76C3A790BD4E93CD02B2F17A4EB351BBC79E1197B419115C48273249
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

blaze

Minor OS version

Major OS version

Entry point

118864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\redst\Downloads\tb (1)\tb\x64\Release\BlazeTriggerbot.pdb

kernel32

WideCharToMultiByte GlobalUnlock CreateMutexA ReleaseMutex GetLastError CloseHandle FreeConsole ReadProcessMemory GetProcessId OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW lstrcmpiW GetProcAddress Sleep GlobalLock InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FindResourceW LoadResource WritePrivateProfileStringA LockResource MultiByteToWideChar SizeofResource ExitProcess GlobalAlloc DeleteFileA GetFileAttributesA CopyFileA GetVolumeInformationA MoveFileA GetModuleFileNameA GetCurrentThread SetThreadPriority GetPrivateProfileStringA GetPrivateProfileIntA CreateDirectoryA GetModuleHandleW

user32

LoadImageW InvalidateRect ReleaseDC GetCursorPos BeginPaint GetClientRect PostMessageW SetProcessDPIAware OpenClipboard CloseClipboard EmptyClipboard SetClipboardData UpdateWindow SendInput GetMessageW MapVirtualKeyW EndPaint DestroyWindow GetDC SetWindowPos SetWindowRgn SendMessageW CallNextHookEx GetSystemMetrics ShowWindow IsWindow GetKeyNameTextA GetAsyncKeyState DispatchMessageW SetTimer DestroyIcon CallWindowProcA SetWindowsHookExA GetWindowTextA SetWindowTextA MessageBoxA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus TranslateMessage LoadCursorW SetCapture GetWindowRect SetForegroundWindow ReleaseCapture RegisterClassExA SetWindowLongPtrA GetParent PostQuitMessage KillTimer DrawIconEx UnregisterClassA UpdateLayeredWindow

gdi32

RemoveFontMemResourceEx DeleteObject SetBkColor SetBkMode SetTextColor DeleteDC CreateRoundRectRgn CreateCompatibleDC CreateDIBSection SelectObject CreateFontA AddFontMemResourceEx BitBlt CreateSolidBrush

advapi32

RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA RegDeleteKeyA RegCloseKey

shell32

SHChangeNotify ShellExecuteA SHGetFolderPathA

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Mtx_unlock _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z

gdiplus

GdipMeasureString GdipSetTextRenderingHint GdipCreateFromHDC GdipDrawString GdipDrawPath GdipFree GdipClosePathFigure GdipGraphicsClear GdipFillPath GdipCreateSolidFill GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipSetSmoothingMode GdipDeletePath GdipAlloc GdipDeleteBrush GdipSetClipRect GdipCreateLineBrushI GdipFillRectangleI GdipCreateFontFamilyFromName GdipResetClip GdipDeleteFontFamily GdipAddPathArc GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreatePen1 GdipNewPrivateFontCollection GdipSetStringFormatAlign GdipDeletePrivateFontCollection GdipPrivateAddMemoryFont GdipDrawLineI GdipSetPenLineCap197819 GdiplusStartup GdiplusShutdown GdipCreateStringFormat

wininet

DeleteUrlCacheEntryA InternetOpenUrlA InternetSetOptionA InternetOpenA InternetCloseHandle InternetReadFile

winhttp

WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy memset memmove memcpy memcmp __current_exception_context __current_exception _CxxThrowException __C_specific_handler strchr strstr __std_terminate

api-ms-win-crt-convert-l1-1-0

atoi strtof strtoull strtol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vsprintf fopen fclose __stdio_common_vfprintf fgets fwrite __stdio_common_vswprintf __stdio_common_vsscanf _set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _c_exit _initialize_onexit_table _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _register_thread_local_exe_atexit_callback _errno terminate _configure_narrow_argv _beginthreadex

api-ms-win-crt-string-l1-1-0

strncpy strcmp strcpy strlen _stricmp isdigit

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-math-l1-1-0

ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale