blustealer | 6bd709d1e9fa41f6d670e1fb39f98632fc6425c80e7c5cfcc038303e7dcd5794 | Triage

Sharing

General

Target

b8725d3210880f518a7c9d32c7776205.exe
Size

440KB
Sample

220909-a73m4agca9
MD5

b8725d3210880f518a7c9d32c7776205
SHA1

40ae36f2bdd77471b2b7f0dc28cfba90da2cc673
SHA256

6bd709d1e9fa41f6d670e1fb39f98632fc6425c80e7c5cfcc038303e7dcd5794
SHA512

a3b3e427673abc060ef0532c1302bc9195d6b0cc2c322b29138bd9952230906bd2d2f2d8ab949c6e37bbb3297fc4a10b3f8d8dded51f8ee4b43467c857aa4f31
SSDEEP

12288:ZBWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:ZexgsRftD0C2nKG

Score

10^/10

blustealer collection

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5446953292:AAFkDq-HVam91vjV2SXkAWjbhfkBnxaPoa4/sendMessage?chat_id=1269002131

Targets

- Target
  
  b8725d3210880f518a7c9d32c7776205.exe
- Size
  
  440KB
- MD5
  
  b8725d3210880f518a7c9d32c7776205
- SHA1
  
  40ae36f2bdd77471b2b7f0dc28cfba90da2cc673
- SHA256
  
  6bd709d1e9fa41f6d670e1fb39f98632fc6425c80e7c5cfcc038303e7dcd5794
- SHA512
  
  a3b3e427673abc060ef0532c1302bc9195d6b0cc2c322b29138bd9952230906bd2d2f2d8ab949c6e37bbb3297fc4a10b3f8d8dded51f8ee4b43467c857aa4f31
- SSDEEP
  
  12288:ZBWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:ZexgsRftD0C2nKG
Score

6^/10

collection
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2