Extracted

• • Target

    SecuriteInfo.com.W32.AIDetectNet.01.22897.12003

  • Size

    825KB

  • MD5

    f10789db721c1dfdf2e74554508f23e7

  • SHA1

    12a2fb70d4e7358fc53e5f19ddfc91ae0f2ea018

  • SHA256

    5e26cb68b7cd24df50916757dd43c5357bcee359d05d8d8649749fdce26d540c

  • SHA512

    72a4cf5ca2d2fe08ee4b1b667e215801d750d1d8580d1fad90e06f0caf579b23969cda58a3534c1777a9617470aac784ba13ce4587ea3e856e7d2858480b7e49

  Score

  10^/10

  persistenceblustealerspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2