Overview

overview

10

Static

static

1

price quote.exe

windows7-x64

10

price quote.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    price quote.exe

  • Size

    574KB

  • Sample

    221212-kpb3jadf6w

  • MD5

    985c89ebdec3c29ea7d3c37bc98984cf

  • SHA1

    5bd5fcc00bce44d3276625f0683aafdfdf2c6a3a

  • SHA256

    5460a91a459c049de389e20ce484875a26ce10a391701d2545f9fbed739bf3e5

  • SHA512

    fcc617119e84a2616829b399daf2158dc0d9d07a60c741b27346296873b93f7edb717a6ec66bd44d919279bc396dfc645d8433c2fa6d2d4e0a920c0e2059f1cb

  • SSDEEP

    12288:orp5mVfyKi7SymriIp6i2OFOeCNYj93778lZ/CKtxH3pOxbS:jVf5oSymriIpH2o5L7cZ6K7H3qS

Score
10/10
blustealercollectionspywarestealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5806519032:AAFXvpc6Ywo24erqs91HjOs76SIn9mEqx8I/sendMessage?chat_id=5798400850

Targets

    • Target

      price quote.exe

    • Size

      574KB

    • MD5

      985c89ebdec3c29ea7d3c37bc98984cf

    • SHA1

      5bd5fcc00bce44d3276625f0683aafdfdf2c6a3a

    • SHA256

      5460a91a459c049de389e20ce484875a26ce10a391701d2545f9fbed739bf3e5

    • SHA512

      fcc617119e84a2616829b399daf2158dc0d9d07a60c741b27346296873b93f7edb717a6ec66bd44d919279bc396dfc645d8433c2fa6d2d4e0a920c0e2059f1cb

    • SSDEEP

      12288:orp5mVfyKi7SymriIp6i2OFOeCNYj93778lZ/CKtxH3pOxbS:jVf5oSymriIpH2o5L7cZ6K7H3qS

    Score
    10/10
    blustealercollectionspywarestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks