blustealer | c5cad95c9244643c337d0bf61b03c9ec9ff854d1354f9c5d4a03577a0ff9578f | Triage

Sharing

General

Target

1708-60-0x0000000000400000-0x000000000046D000-memory.dmp
Size

436KB
Sample

220920-th57gahbgq
MD5

9de282dd47c5037428eeb4a8979f10dc
SHA1

1a381d221b9ce37ee59a3e6f8eb46d542b9450a0
SHA256

c5cad95c9244643c337d0bf61b03c9ec9ff854d1354f9c5d4a03577a0ff9578f
SHA512

13bd26e046672c524b292a9b8e712de0fa055082462fbdd3831cdb5238519cb536d27a4abce35b475ac72d641b95170b65e2ac60fecaed8776a3390c95cb4b2e
SSDEEP

12288:ZWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:mxgsRftD0C2nKG

Score

10^/10

blustealer collection

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5351997584:AAEyh4aj9rNp8tJtHYZqoYG-PSzq-z5M18M/sendMessage?chat_id=1374455932

Targets

- Target
  
  1708-60-0x0000000000400000-0x000000000046D000-memory.dmp
- Size
  
  436KB
- MD5
  
  9de282dd47c5037428eeb4a8979f10dc
- SHA1
  
  1a381d221b9ce37ee59a3e6f8eb46d542b9450a0
- SHA256
  
  c5cad95c9244643c337d0bf61b03c9ec9ff854d1354f9c5d4a03577a0ff9578f
- SHA512
  
  13bd26e046672c524b292a9b8e712de0fa055082462fbdd3831cdb5238519cb536d27a4abce35b475ac72d641b95170b65e2ac60fecaed8776a3390c95cb4b2e
- SSDEEP
  
  12288:ZWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:mxgsRftD0C2nKG
Score

6^/10

collection
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2