Extracted

• • Target

    Invoice and packing list.exe

  • Size

    512KB

  • MD5

    7c6e72138a75a71d10bcb10eab3e17fc

  • SHA1

    2846f854795ead06fc2f551c101c6047e02c279a

  • SHA256

    61660da7d55fa8074c7d4ed0a26f3ae021321dee8bf5d7651c394bccde2748c7

  • SHA512

    b7d046ce70c4d4e8f044659162baf19656ca82c7585c8028322075912ea86b4e43043aead2d02c54d9d2a7c7004f10ea4e822851d297ac7ee0b741d6a8873820

  • SSDEEP

    12288:qDqx3btvdiCWUJUKsqvIwuycqABZ7jGZZFR3+J+Ei:qWx3ldRWUawbABZOzFZw+Ei

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2