General

  • Target

    6f5748c69eb521632a3ba9757852672895c983c0886e8cddaa4dd4266f2e5a46

  • Size

    1.2MB

  • Sample

    221007-s2zy5acge9

  • MD5

    b63bd686cca7a0de40ba595e1c55c3df

  • SHA1

    c8a7b28371decc264b410bf48beded50b8038a4c

  • SHA256

    6f5748c69eb521632a3ba9757852672895c983c0886e8cddaa4dd4266f2e5a46

  • SHA512

    c6f11a341630e6accfe78736f13286ab674a7095c14074fb1a84c96d5b587e8f79060d80957164760896347fcb85cf7708a9745fe22e9f5b6df86fcd0303752e

  • SSDEEP

    12288:c2iNIJ2uJUpVLOmO3/XAonActMpNgsUF2SEFvxnvXjNWODQLadmpA8SDhY+Cc0XL:c1nppUPA9HlUsvZoKNmOrT0XwJJl

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Targets

    • Target

      6f5748c69eb521632a3ba9757852672895c983c0886e8cddaa4dd4266f2e5a46

    • Size

      1.2MB

    • MD5

      b63bd686cca7a0de40ba595e1c55c3df

    • SHA1

      c8a7b28371decc264b410bf48beded50b8038a4c

    • SHA256

      6f5748c69eb521632a3ba9757852672895c983c0886e8cddaa4dd4266f2e5a46

    • SHA512

      c6f11a341630e6accfe78736f13286ab674a7095c14074fb1a84c96d5b587e8f79060d80957164760896347fcb85cf7708a9745fe22e9f5b6df86fcd0303752e

    • SSDEEP

      12288:c2iNIJ2uJUpVLOmO3/XAonActMpNgsUF2SEFvxnvXjNWODQLadmpA8SDhY+Cc0XL:c1nppUPA9HlUsvZoKNmOrT0XwJJl

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks