blustealer | 5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977[.]exe

General

Target
5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977.exe
Size 125KB
Sample230306-rbh29aca9x
SHA256 5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977
MD5 88eeeb298fabd21ef29c0b89d7aee4f9
SHA1 6ceb6efa6b16293c8ab278d9f4276ad9af1ca653
SHA512 0ac2637718ca22b7ee102360fd324761b24e13c991615f93c7f6f8ede72474a372f3f664fac5bd72d04d4977c388d401c3bcaf6d78e655e31eba2b6a4b4b1547
SSDEEP 1536:A/w/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioZkcOqJ40eZgYAv:A0ZTkLfhjFSiO3o3kcqZZG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blustealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5369570306:AAGakouymXOc8dp0WUuP_KaS81h9taRj_pk/sendMessage?chat_id=1884866272

Signatures

Blustealer family
blustealer

File Explorer

5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977.exe

.exe 125KB

5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977.exe

IMPHASH 4f7271df0bf201cf627af3103fba2c2e
SHA256 5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977
MD5 88eeeb298fabd21ef29c0b89d7aee4f9
SHA1 6ceb6efa6b16293c8ab278d9f4276ad9af1ca653
SHA512 0ac2637718ca22b7ee102360fd324761b24e13c991615f93c7f6f8ede72474a372f3f664fac5bd72d04d4977c388d401c3bcaf6d78e655e31eba2b6a4b4b1547
SSDEEP 1536:A/w/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioZkcOqJ40eZgYAv:A0ZTkLfhjFSiO3o3kcqZZG
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6572

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList ord516 _adj_fprem1 __vbaStrCat __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj _adj_fdiv_m32 ord666 ord667 __vbaAryDestruct ord593 __vbaExitProc __vbaForEachCollObj ord594 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i _CIsin __vbaErase ord709 ord631 ord632 ord525 __vbaNextEachCollObj __vbaVarZero __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaAryConstruct2 __vbaI2I4 __vbaObjVar DllFunctionCall __vbaFpUI1 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaRedim EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaStrUI1 __vbaExceptHandler __vbaPrintFile __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 __vbaFPException ord532 ord717 __vbaStrVarVal __vbaUbound __vbaGetOwner3 __vbaVarCat ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaNew2 __vbaInStr ord648 ord570 __vbaVar2Vec _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaFreeStrList __vbaDerefAry1 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 ord579 __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaStrToAnsi __vbaVarDup __vbaVarCopy ord616 __vbaFpI4 __vbaVarLateMemCallLd __vbaLateMemCallLd _CIatan ord618 __vbaAryCopy __vbaStrMove __vbaCastObj __vbaR8IntI4 __vbaStrVarCopy _allmul _CItan __vbaAryUnlock _CIexp ord580 __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing