Essential information

Value / Name

01ad9b41772f434d6433e48468f3664b1adfcb2f

Confidence

100/100

Revoked

Yes

Valid from

02/11/2022 15:34

Valid until

05/02/2024 15:34

Pattern type

yara

Published

20/12/2025 19:36

Modified

20/12/2025 22:39

Author / Source

AlienVault

Description

Pattern

rule infostealer_win_bluefox {
    meta:
        malware = "BlueFox"
        description = "Find BlueFox Stealer v2 samples based on the specific strings embed in the executable files"
        source = "SEKOIA.IO"
        reference = "https://blog.sekoia.io/bluefox-stealer-a-newcomer-designed-for-traffers-teams/"
        classification = "TLP:CLEAR"

    strings:
        $str01 = "DesktopScreenshotLength" ascii
        $str02 = "SoftwareSearchesCount" ascii
        $str03 = "AutoCompleteLength" ascii
        $str04 = "DesktopSizeLength" ascii
        $str05 = "CPULength" ascii
        $str06 = "GPUsLength" ascii
        $str07 = "FullNameLength" ascii
        $str08 = "Asn1NssLength" ascii
        $str09 = "LoginLength" ascii
        $str10 = "BrowserCount" ascii

    condition:
        uint16(0)==0x5A4D and 9 of them
}

Labels / Tags

Labels: bluefox smokeloader stealer

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.