Extracted

• • Target

    DEKONT_P.EXE.exe

  • Size

    1.3MB

  • MD5

    37b87a3acbb3e3926f6bd65a86fec7fc

  • SHA1

    73f0ffd7fabe1e02f25b3cae3fa1c0b92235c33c

  • SHA256

    c75c9aa6a59390063715c53c31d399ee5da8d2e03dd7abaae9e369d4b4e5354c

  • SHA512

    2aa63a46e09a698ebe6d5b8bf0f61f016259813a576d1038ed0b34b40b9ee552b88b34a4940f7a16692c604afe06c95c0a892e28bfb66a0a71a9db76f2209f19

  • SSDEEP

    24576:IYPxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNussjBuIUJ:yjUMOrbugDNySH3DN6Fdj

  Score

  10^/10

  blustealercollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2