blustealer | 091e5425d20566800181ee8498a0d9b15019fe9283f7845acb64a6cf6aaf8495 | Triage

Sharing

General

Target

cf67f07fddf91a4c144075e5e4c5988acfa30aaf439d0c31f5a309e094bc0270
Size

381KB
Sample

220824-dfdrfafccp
MD5

02eb762c8ca3cf642480af1b3da74e46
SHA1

6a63099ee5ec4156dd64b09ea0ddb9b34814f0e0
SHA256

091e5425d20566800181ee8498a0d9b15019fe9283f7845acb64a6cf6aaf8495
SHA512

926851f142117042d2ecb10d078281e5dfc77fa4f52e3ece3d6917ec52556ed70757c5155e99ca3fddbfd29a6af725f6cf5be0471f02c3b734edd3a8ebb28811
SSDEEP

6144:8hJfyzdGogKgbUR/kFqdYfBuFZp1iY0aE1q7FRl62nX8riSugaogIIu40AW9z:aJfyxxfggRLUu/7LAyFRc2nsOpNnUz

Score

10^/10

blustealer collection

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5432809476:AAHtE5EDW3VQZZBLnEbEZpHEIJz5LbF0no/sendMessage?chat_id=5571556378

Targets

- Target
  
  cf67f07fddf91a4c144075e5e4c5988acfa30aaf439d0c31f5a309e094bc0270
- Size
  
  440KB
- MD5
  
  cbe965aab3f57da4ceda5886e90db6b4
- SHA1
  
  87d28f5af169e11cf570e5b709e407aebc33aa2c
- SHA256
  
  cf67f07fddf91a4c144075e5e4c5988acfa30aaf439d0c31f5a309e094bc0270
- SHA512
  
  e7b9a33974cba07f5d1430fdfaf0884e4210188049d9a3f56765f14a62d405bb8699d5c53fbb22d2c82d894f7ed7a6122a55ca43c7abcdc719d0b518f7cb4697
- SSDEEP
  
  12288:RWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:OxgsRftD0C2nKG
Score

6^/10

collection
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2