blustealer | 4a1765c1b14391c05f9dabc20c15bdf3fca85f5960cffc8c8291b50d26be8eba | Triage

Sharing

General

Target

1160-60-0x0000000000400000-0x000000000046E000-memory.dmp
Size

440KB
Sample

220804-ky38dadac5
MD5

68dec1634d8700be0eea8f6bcb101868
SHA1

f32776bf743d530816168928074a0364894a54b5
SHA256

4a1765c1b14391c05f9dabc20c15bdf3fca85f5960cffc8c8291b50d26be8eba
SHA512

674c4d0f44b75e99647ea75d7e2173f7d228091e8dcc6cb22ebfe73e8e25a34d28fe30fc8821fa43239efc4e80f03190d10376fa3f2ce2c3afb81dbc0dd3f429

Score

10^/10

blustealer collection

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5449766717:AAHzRorvKI5URgvleGHlq6ZvqElY68-XL18/sendMessage?chat_id=1293496579

Targets

- Target
  
  1160-60-0x0000000000400000-0x000000000046E000-memory.dmp
- Size
  
  440KB
- MD5
  
  68dec1634d8700be0eea8f6bcb101868
- SHA1
  
  f32776bf743d530816168928074a0364894a54b5
- SHA256
  
  4a1765c1b14391c05f9dabc20c15bdf3fca85f5960cffc8c8291b50d26be8eba
- SHA512
  
  674c4d0f44b75e99647ea75d7e2173f7d228091e8dcc6cb22ebfe73e8e25a34d28fe30fc8821fa43239efc4e80f03190d10376fa3f2ce2c3afb81dbc0dd3f429
Score

6^/10

collection
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2