Extracted

• • Target

    RFQ # 2075873.xls

  • Size

    511KB

  • MD5

    97e3a7667e8059ea5ab1a490fd143e59

  • SHA1

    1fd7e6aa7c2e4b3b712e8fda94c7193ef4a67dc9

  • SHA256

    a651e0f35126e939ac640191f047ae61ce3730fc6cf7cd8e62227e41125f79c6

  • SHA512

    9b17b3f9daf5322a39377866f95876ccd7947761ae761e60ba82da7add73e4a7922df5c4db40b3e0084450e252515bc1f833b3149962b37b322d923abd1e6e33

  • SSDEEP

    12288:pdNqrDx7XXXXXXXXXXXXUXXXXXXXrXXXXXXXXEmYQTm/TmIguOkIceSRsq2Za:gr5XXXXXXXXXXXXUXXXXXXXrXXXXXXXw

  Score

  10^/10

  blustealercollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2