Overview

overview

10

Static

static

1

Request Fo...on.exe

windows7-x64

10

Request Fo...on.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cde1978c4a678168a1e18f3dd06fd4f1.bin

  • Size

    488KB

  • Sample

    230224-ccenwsbg7w

  • MD5

    99ff1f9b63e268d674b234289f230397

  • SHA1

    ffd18d0e7bf91e875f39f22d207028e576c95ef5

  • SHA256

    acb86c2712e428b935696cb13e6655b0253481e956fdc67122f3148231f66e65

  • SHA512

    fee09d39aec029da57601682750b329f631cb2fbf1408735d98d07cb2c5c5c38a1bf7fa878baec227266dba242eb91b81d79915427fa517a8613e9ad52d0f87b

  • SSDEEP

    12288:rYsAOPGSDpAAFrU/wQbD3GTrxYzqh3R5beegDRX2Vcn5V96:cOGSFTFr0/brGTrxY0h5Keg8cn5VM

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      Request For Quotation.exe

    • Size

      502KB

    • MD5

      e6759016429ab2d38c9a9497325c5746

    • SHA1

      8d4a9bd427e937d523968d57f8bced231189624e

    • SHA256

      20919ab5a667f7a8ef3d7d1e614f3e448bf875a066ac56c257e2e07878f6e336

    • SHA512

      f266a3958d48efc6a9b105c62eb0cfd8d30e810b3f247e065b9b62a0f62f70642b1964a7d570f22f16a64cd1430cfa25c3de53201282773b1bd0b5ef352485b1

    • SSDEEP

      12288:vYqsd1RU0HAn7av42cnY/jVFIegYLTvEOLhPMuOBmO:vYqsd1DZ42ci7lLTsOBMucmO

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks