Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
21-09-2022 06:39
General
-
Target
1796-71-0x0000000000400000-0x0000000000AC1000-memory.exe
-
Size
6.8MB
-
MD5
b6c2d4816d6c40cfb22ddad2e3c9159c
-
SHA1
6ad65d011215a2e018c88665ed2c0822d350045c
-
SHA256
87a1a5c6bd201ff5a9ad9d23cdadb4433081a86011b2fbf58a54608f567e3388
-
SHA512
c0834d8b117f51844f8323748e40ea491a941ea7e9eace61a0bf4d3f34ea0689721eb82a5a07ec10a8c5cd8a186d87704803c38b107a1da2e26515cf1d4ad1a7
-
SSDEEP
98304:/zWmTVckvgF5Y/3qDLSWBVDXALy/NUaKXTgsWJmt13VGdAQV4R0wizugbdgLD3D1:/z7XSBAh9Omt1FGdAhR0Fbdgv3DhAz
Score
10/10
Malware Config
Extracted
Family
blustealer
C2
https://api.telegram.org/bot5351997584:AAEyh4aj9rNp8tJtHYZqoYG-PSzq-z5M18M/sendMessage?chat_id=1374455932
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1796-71-0x0000000000400000-0x0000000000AC1000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1796-71-0x0000000000400000-0x0000000000AC1000-memory.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB