General

  • Target

    SecuriteInfo.com.Variant.Barys.42241.11208.10553

  • Size

    873KB

  • Sample

    220804-kwv4zschh7

  • MD5

    0cf7d7bfef7f90ec7738d843de48f8b0

  • SHA1

    1d1acaa521f0b04301d350831c97d0d4cc34e2f7

  • SHA256

    91be6258668b873244ec00091e663437dbb0967ee31406538376560de2b9a0e2

  • SHA512

    43a22929ffc929f4b4de106b307bd68b50a82d34166f12b300411e530066912872d1e321562e7747aa40a5c75fa955e06391db6d2adaef98a76f42ff8dd5c61a

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5449766717:AAHzRorvKI5URgvleGHlq6ZvqElY68-XL18/sendMessage?chat_id=1293496579

Targets

    • Target

      SecuriteInfo.com.Variant.Barys.42241.11208.10553

    • Size

      873KB

    • MD5

      0cf7d7bfef7f90ec7738d843de48f8b0

    • SHA1

      1d1acaa521f0b04301d350831c97d0d4cc34e2f7

    • SHA256

      91be6258668b873244ec00091e663437dbb0967ee31406538376560de2b9a0e2

    • SHA512

      43a22929ffc929f4b4de106b307bd68b50a82d34166f12b300411e530066912872d1e321562e7747aa40a5c75fa955e06391db6d2adaef98a76f42ff8dd5c61a

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks