Extracted

• • Target

    DEKONT_P.EXE.exe

  • Size

    1.3MB

  • MD5

    5afe8e13c85ca1b13566776bf95c8307

  • SHA1

    0c4f45714b140392797f1d8aad65da71a0ef9aaf

  • SHA256

    9ee2d324d8076b2b924ebdfbc678165a46089b8e413b292da28f6e9724e657a2

  • SHA512

    01310091d805126b39a87871202e82703d0e1a5202e90bed3fcf1af93a04dd73e9752cf72a42b7697cd2d6f09192214994cfb74dc5390ebd2125914c235777ae

  • SSDEEP

    24576:3QxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNussoiCZXqP:Ap6wgt6tM2QU2p2KwFdj

  Score

  10^/10

  blustealercollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2