blustealer | 87a1a5c6bd201ff5a9ad9d23cdadb4433081a86011b2fbf58a54608f567e3388

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2022 06:39

Target

1796-71-0x0000000000400000-0x0000000000AC1000-memory.exe
Size

6.8MB
MD5

b6c2d4816d6c40cfb22ddad2e3c9159c
SHA1

6ad65d011215a2e018c88665ed2c0822d350045c
SHA256

87a1a5c6bd201ff5a9ad9d23cdadb4433081a86011b2fbf58a54608f567e3388
SHA512

c0834d8b117f51844f8323748e40ea491a941ea7e9eace61a0bf4d3f34ea0689721eb82a5a07ec10a8c5cd8a186d87704803c38b107a1da2e26515cf1d4ad1a7
SSDEEP

98304:/zWmTVckvgF5Y/3qDLSWBVDXALy/NUaKXTgsWJmt13VGdAQV4R0wizugbdgLD3D1:/z7XSBAh9Omt1FGdAhR0Fbdgv3DhAz

Score

10^/10

Family

blustealer

https://api.telegram.org/bot5351997584:AAEyh4aj9rNp8tJtHYZqoYG-PSzq-z5M18M/sendMessage?chat_id=1374455932

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/4512-132-0x0000000000400000-0x0000000000AC1000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4420	4512	WerFault.exe	77

C:\Users\Admin\AppData\Local\Temp\1796-71-0x0000000000400000-0x0000000000AC1000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1796-71-0x0000000000400000-0x0000000000AC1000-memory.exe"
1⤵
PID:4512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 224
  2⤵
  - Program crash
  PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4512 -ip 4512
1⤵
PID:2444

memory/4512-132-0x0000000000400000-0x0000000000AC1000-memory.dmp

Filesize
6.8MB

Download