Overview

overview

10

Static

static

1

PO 152421.exe

windows7-x64

10

PO 152421.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    32d53c26b439754a3bd184a82652676f.bin

  • Size

    486KB

  • Sample

    230223-bgn8fsec65

  • MD5

    d36d298ef7e3e581d6a4afdf660651b7

  • SHA1

    65d059cfe0732aef5f307e14bf2c1c01ce6c0912

  • SHA256

    496f735b755cd59ebad7a163c57147e81adb648ae981032dd62647bd05ea7fd2

  • SHA512

    ea8e9419f740e84f37fcf3adb7361a4f412e819c0c21eb5dcfdd30c487dbeeb108eebeab243d1854b74d409db47a63095b79d4b98c604bd740fb9c987aa568cb

  • SSDEEP

    12288:FfqShr69NvMuywkiCUIYOzaHBhJFC0nZ6P19APEO230:BqqrCl9ywZCUIYvBU0ns8Pn230

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Targets

    • Target

      PO 152421.exe

    • Size

      501KB

    • MD5

      460bdbbe5a6b8bd3f887c8b6fd4128a2

    • SHA1

      891099bcbf82de10e1b197d2c42b2044dc0bed46

    • SHA256

      58d5286e5694f883d2452a81e5f6e77413292ba388300a6e44dd0f91e217aff1

    • SHA512

      b741e4bc33762adc9dee71f7a348ec9e7615bd4631bb73c39e4d69a01e8d469a3eb1aa303c691e2671aa939c223c6fc4a5bc05b2dea23b40f3e5422e2b4b3c6c

    • SSDEEP

      12288:/YFfpyLOuydXBmm+vie9mUX1NqRBchWc6P0vMLxJRg0ExsOPn7jhPhl9iqo+/:/YFhyCuCoie9nFNqgL6P0vlLxVP7FT93

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks