General

  • Target

    d794c27fbcf5de096750f2be32587d19cab1364b6fdd86318685574dedeb5af4.exe

  • Size

    1.2MB

  • Sample

    221212-yj82zafb8s

  • MD5

    db8113681e395345f71223c1d18e40c4

  • SHA1

    617ab388348ce4fa1bd203caa5558e570467db11

  • SHA256

    d794c27fbcf5de096750f2be32587d19cab1364b6fdd86318685574dedeb5af4

  • SHA512

    70302b571a40585a2776b8686fc9ac507456a317d1ab22dd6c43eba028d15ce2bef9bde0bf694d007869cb474c78b2706fc203f3608816819e9034ef76465b92

  • SSDEEP

    24576:JxqZRqOIRqOMub30RfQVipC2mdQSDGSDFBi/txagaLNAJ4iTiwAAgEEY4:J3z0aiplJSDji1xawiiTQp

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      d794c27fbcf5de096750f2be32587d19cab1364b6fdd86318685574dedeb5af4.exe

    • Size

      1.2MB

    • MD5

      db8113681e395345f71223c1d18e40c4

    • SHA1

      617ab388348ce4fa1bd203caa5558e570467db11

    • SHA256

      d794c27fbcf5de096750f2be32587d19cab1364b6fdd86318685574dedeb5af4

    • SHA512

      70302b571a40585a2776b8686fc9ac507456a317d1ab22dd6c43eba028d15ce2bef9bde0bf694d007869cb474c78b2706fc203f3608816819e9034ef76465b92

    • SSDEEP

      24576:JxqZRqOIRqOMub30RfQVipC2mdQSDGSDFBi/txagaLNAJ4iTiwAAgEEY4:J3z0aiplJSDji1xawiiTQp

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks