Overview

overview

10

Static

static

a651e0f351...c6.xls

windows7-x64

10

a651e0f351...c6.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a651e0f35126e939ac640191f047ae61ce3730fc6cf7cd8e62227e41125f79c6.zip

  • Size

    357KB

  • Sample

    221114-lpzn9sgd98

  • MD5

    a60e16e16818672654a2388e2df8e3e0

  • SHA1

    a76e55b312b9a7d3c099eb56e2f42769b7d98c18

  • SHA256

    3c5b2804cd77744eacb52283b8150700eb29ce59a3bbff888fea36223922774a

  • SHA512

    fa9dc10816ef64c7e7b6f1cda2b78bc64e9f03206ee651ef5f37fbfa2dd4b2e6f3635ec68d9c2c32074b3729f227bd4e5c0c5d218b522e13e708c70a32f829cd

  • SSDEEP

    6144:AcJoh3Xk0p17r9tyfa3VdM+gFR6Ia7/W8TaDbdxjJMHr/cn2AQTFxhxqsEXWTw/s:Zo1Xku17htyfqJcRa7+8mDbdhyr/cdQp

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Targets

    • Target

      a651e0f35126e939ac640191f047ae61ce3730fc6cf7cd8e62227e41125f79c6.xls

    • Size

      511KB

    • MD5

      97e3a7667e8059ea5ab1a490fd143e59

    • SHA1

      1fd7e6aa7c2e4b3b712e8fda94c7193ef4a67dc9

    • SHA256

      a651e0f35126e939ac640191f047ae61ce3730fc6cf7cd8e62227e41125f79c6

    • SHA512

      9b17b3f9daf5322a39377866f95876ccd7947761ae761e60ba82da7add73e4a7922df5c4db40b3e0084450e252515bc1f833b3149962b37b322d923abd1e6e33

    • SSDEEP

      12288:pdNqrDx7XXXXXXXXXXXXUXXXXXXXrXXXXXXXXEmYQTm/TmIguOkIceSRsq2Za:gr5XXXXXXXXXXXXUXXXXXXXrXXXXXXXw

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks