blustealer | a79e9aff885b5aa305517c3836d10be1[.]exe

General

Target
a79e9aff885b5aa305517c3836d10be1.exe
Size 440KB
Sample220909-bmtp5adcek
SHA256 1c5bf7e3edbccd4fe44d97baba8529438169f346769e109b2b660d1b45b2a02b
MD5 a79e9aff885b5aa305517c3836d10be1
SHA1 a71d4faf5b3d863144d361129c4f52b6e66de27d
SHA512 d8d7f5ed21a3c76c6ffa430f44f964d76529fb31c6eb4a838b5b74265a5c989d239111b530fb3673358ef70fc0a51e6adb0630dca0fbfe72a66b9802d2d9fd4f
SSDEEP 12288:d8WnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:dnxgsRftD0C2nKG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blustealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5535376508:AAGIkj1WObA9laUkCoGdCF3fvIC_BvhvWso/sendMessage?chat_id=5379877658

Signatures

Blustealer family
blustealer

File Explorer

a79e9aff885b5aa305517c3836d10be1.exe

.exe 440KB

a79e9aff885b5aa305517c3836d10be1.exe

IMPHASH df8fbcbe90e1e305a660f0ac2aa4fae4
SHA256 1c5bf7e3edbccd4fe44d97baba8529438169f346769e109b2b660d1b45b2a02b
MD5 a79e9aff885b5aa305517c3836d10be1
SHA1 a71d4faf5b3d863144d361129c4f52b6e66de27d
SHA512 d8d7f5ed21a3c76c6ffa430f44f964d76529fb31c6eb4a838b5b74265a5c989d239111b530fb3673358ef70fc0a51e6adb0630dca0fbfe72a66b9802d2d9fd4f
SSDEEP 12288:d8WnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:dnxgsRftD0C2nKG
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6684

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaStrVarMove __vbaLenBstr __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList ord516 _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat ord660 __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj _adj_fdiv_m32 ord666 ord667 __vbaAryDestruct ord593 __vbaExitProc __vbaForEachCollObj ord594 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i _CIsin ord709 ord631 ord632 ord525 __vbaNextEachCollObj __vbaVarZero __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaAryConstruct2 __vbaVarTstEq __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt __vbaFpUI1 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler __vbaPrintFile __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 __vbaFPException ord532 ord717 __vbaStrVarVal __vbaUbound __vbaGetOwner3 __vbaVarCat ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaNew2 __vbaInStr ord648 ord570 __vbaVar2Vec _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaFreeStrList __vbaDerefAry1 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 ord579 __vbaVarSetVar __vbaAryLock __vbaLateMemCall __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaVarCopy ord616 __vbaFpI4 __vbaVarLateMemCallLd __vbaRecDestructAnsi __vbaLateMemCallLd _CIatan ord618 __vbaStrMove __vbaCastObj __vbaR8IntI4 __vbaStrVarCopy _allmul _CItan ord546 __vbaAryUnlock _CIexp ord580 __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing