Extracted

• • Target

    Request for quotation.exe

  • Size

    504KB

  • MD5

    3db74116bfd3320ecf106e9143260cea

  • SHA1

    fa3b311a33b9f903f570494561c5c5a679d14808

  • SHA256

    54ccc28b6adc020ce06f485e2e8d300b1871b52d55a280f2a06ec405dd9b5184

  • SHA512

    a9210243e6679cffaf296f6e11a49ee75d80fe1b5400a38a2a18e5b17fc5b13680c4b00b9942130d281353b9c7265b96c3d22216eb1c21635ca22357018dfa05

  • SSDEEP

    12288:3+Mp3mHUy1aI4LIvYfk9bADwcYHcSTWy3mE7v:/EHahfwADXS6y17v

  Score

  10^/10

  blustealercollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2