blustealer | 41e787b14405013e4d786f338571e949763e07936daef3fe49a035078aca6e03 | Triage

Sharing

General

Target

276-59-0x0000000000400000-0x000000000046E000-memory.dmp
Size

440KB
Sample

220805-hvbylshcck
MD5

427c5cbbbfc4d96dbe84cab72292a032
SHA1

28f5d477a43fcfbe39100b510e52df794ca0382d
SHA256

41e787b14405013e4d786f338571e949763e07936daef3fe49a035078aca6e03
SHA512

ea8fc1bf8fbb27392cb68dbf05d4186b91f247f87593f252cceba9b07e7c76e9056381fce1ee3a082768382c3d169657a2f014f96905418076cc2f4db9c223bd

Score

10^/10

blustealer collection

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5446953292:AAFkDq-HVam91vjV2SXkAWjbhfkBnxaPoa4/sendMessage?chat_id=1269002131

Targets

- Target
  
  276-59-0x0000000000400000-0x000000000046E000-memory.dmp
- Size
  
  440KB
- MD5
  
  427c5cbbbfc4d96dbe84cab72292a032
- SHA1
  
  28f5d477a43fcfbe39100b510e52df794ca0382d
- SHA256
  
  41e787b14405013e4d786f338571e949763e07936daef3fe49a035078aca6e03
- SHA512
  
  ea8fc1bf8fbb27392cb68dbf05d4186b91f247f87593f252cceba9b07e7c76e9056381fce1ee3a082768382c3d169657a2f014f96905418076cc2f4db9c223bd
Score

6^/10

collection
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2