General

  • Target

    55e7ae74a44323c6d513247d3e863be0.exe

  • Size

    278KB

  • Sample

    220921-gzxkfabacn

  • MD5

    55e7ae74a44323c6d513247d3e863be0

  • SHA1

    78153fac76ddeff2c6abbbb258f1bc1eaf81e20e

  • SHA256

    2e58a9fe640311fd721558f88275088aebe5333936b2d606264220d361c6de90

  • SHA512

    01cab8b425a5b2f116f8cff745402f03ee0755fad0663105b498cef8292748c052cac5ddf57f52b650771aea1d0baa890f1fd6327a45ff3c338bf98d2dfe9214

  • SSDEEP

    6144:NoHFAN2yKhbBMA4Rav5nthcUMdthf1WlA:eHFAWhbBHbhcUEntWC

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5351997584:AAEyh4aj9rNp8tJtHYZqoYG-PSzq-z5M18M/sendMessage?chat_id=1374455932

Targets

    • Target

      55e7ae74a44323c6d513247d3e863be0.exe

    • Size

      278KB

    • MD5

      55e7ae74a44323c6d513247d3e863be0

    • SHA1

      78153fac76ddeff2c6abbbb258f1bc1eaf81e20e

    • SHA256

      2e58a9fe640311fd721558f88275088aebe5333936b2d606264220d361c6de90

    • SHA512

      01cab8b425a5b2f116f8cff745402f03ee0755fad0663105b498cef8292748c052cac5ddf57f52b650771aea1d0baa890f1fd6327a45ff3c338bf98d2dfe9214

    • SSDEEP

      6144:NoHFAN2yKhbBMA4Rav5nthcUMdthf1WlA:eHFAWhbBHbhcUEntWC

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Downloads MZ/PE file

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks