Overview

overview

10

Static

static

1

PO 152421.exe

windows7-x64

10

PO 152421.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO 152421.gz

  • Size

    486KB

  • Sample

    230221-v8tf2afg35

  • MD5

    32d53c26b439754a3bd184a82652676f

  • SHA1

    0d2576fa008ed063817c214466695b87073380cc

  • SHA256

    b520c3f9254212589ec7da68647cebb4fd8cc2390aa90febf51c76dc8af3985d

  • SHA512

    9d49d17ad488544988c57f2f71dcb97f17c1392fb9fbdabc4696e05b51b233077f4220a5fdca04b14f174fa7d5dfa4e39abbf5cbcece98905a430d0e429ced7a

  • SSDEEP

    12288:N2P66djpK3vhdjsqPx4j6tLHbPDEx5dwS2:cP66dEv5x4SHXq5dwH

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Targets

    • Target

      PO 152421.exe

    • Size

      501KB

    • MD5

      460bdbbe5a6b8bd3f887c8b6fd4128a2

    • SHA1

      891099bcbf82de10e1b197d2c42b2044dc0bed46

    • SHA256

      58d5286e5694f883d2452a81e5f6e77413292ba388300a6e44dd0f91e217aff1

    • SHA512

      b741e4bc33762adc9dee71f7a348ec9e7615bd4631bb73c39e4d69a01e8d469a3eb1aa303c691e2671aa939c223c6fc4a5bc05b2dea23b40f3e5422e2b4b3c6c

    • SSDEEP

      12288:/YFfpyLOuydXBmm+vie9mUX1NqRBchWc6P0vMLxJRg0ExsOPn7jhPhl9iqo+/:/YFhyCuCoie9nFNqgL6P0vlLxVP7FT93

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks