Overview

overview

10

Static

static

1

20919ab5a6...36.exe

windows7-x64

10

20919ab5a6...36.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20919ab5a667f7a8ef3d7d1e614f3e448bf875a066ac56c257e2e07878f6e336.zip

  • Size

    489KB

  • Sample

    230321-qp27lsae57

  • MD5

    b8fcbec07e50ea9c62d69453ec2b62c6

  • SHA1

    3e02e6c7583e844c061e127b55a06117ce83f91d

  • SHA256

    cfc9d52cf3a1626fa81c09207167601ccb9fc7c0c81d3a9b16fd11a5db429cfb

  • SHA512

    e0d1efdde6a8b4ffc4396a19bbbd355b0b96dbb1b5178af81b1caa2b53e94b7ba519d64ac7da8a1b09ef49a2a46fca4ae769d8d759486fa8874716a81210cecf

  • SSDEEP

    12288:XLRfpkZhW09KkzkieB1qiUapI9vB2kvc6Q:FfrUKikzzqBNjQ

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      20919ab5a667f7a8ef3d7d1e614f3e448bf875a066ac56c257e2e07878f6e336.exe

    • Size

      502KB

    • MD5

      e6759016429ab2d38c9a9497325c5746

    • SHA1

      8d4a9bd427e937d523968d57f8bced231189624e

    • SHA256

      20919ab5a667f7a8ef3d7d1e614f3e448bf875a066ac56c257e2e07878f6e336

    • SHA512

      f266a3958d48efc6a9b105c62eb0cfd8d30e810b3f247e065b9b62a0f62f70642b1964a7d570f22f16a64cd1430cfa25c3de53201282773b1bd0b5ef352485b1

    • SSDEEP

      12288:vYqsd1RU0HAn7av42cnY/jVFIegYLTvEOLhPMuOBmO:vYqsd1DZ42ci7lLTsOBMucmO

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks