General
-
Target
Invoice and packing list.exe
-
Size
911KB
-
Sample
221221-rrwchscd77
-
MD5
ac6eeec739e6744155d762c71658ee08
-
SHA1
fd00d02ddebab59c5e1284acfc61489ee65506f6
-
SHA256
d02548b41a1f0e68f77df66f87b5664edb454744be93cc02500ccf083ae61ba3
-
SHA512
0720bf1fe12baa9a5689f5c5806017c82c6fd7acfeb53fe960168d1e3569ec86f7c25c87871b3270dfbf568547a27d425a51f6c1f52f0175b3fc12757cca7f63
-
SSDEEP
24576:I1wzlArxvk6SpZnUdY5hvLD5lRcMegGFVdp6c84OCuD1Xli:IOzCSzodYf5gMeg6docdlyb
Static task
static1
Behavioral task
behavioral1
Sample
Invoice and packing list.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Invoice and packing list.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5982631795:AAFe1A7BEPv_6ExMz851LxdOAjr_9gqH8zY/sendMessage?chat_id=5968311109
Targets
-
-
Target
Invoice and packing list.exe
-
Size
911KB
-
MD5
ac6eeec739e6744155d762c71658ee08
-
SHA1
fd00d02ddebab59c5e1284acfc61489ee65506f6
-
SHA256
d02548b41a1f0e68f77df66f87b5664edb454744be93cc02500ccf083ae61ba3
-
SHA512
0720bf1fe12baa9a5689f5c5806017c82c6fd7acfeb53fe960168d1e3569ec86f7c25c87871b3270dfbf568547a27d425a51f6c1f52f0175b3fc12757cca7f63
-
SSDEEP
24576:I1wzlArxvk6SpZnUdY5hvLD5lRcMegGFVdp6c84OCuD1Xli:IOzCSzodYf5gMeg6docdlyb
Score10/10-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext
-