Overview

overview

10

Static

static

1

1cd904a688...4b.exe

windows7-x64

10

1cd904a688...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b.zip

  • Size

    486KB

  • Sample

    230321-qp27lsce8w

  • MD5

    88c9d4c2deed8917eccffe0f729affe3

  • SHA1

    c5c9195b039bc5f7030800fd710b10e40871c211

  • SHA256

    8454d6c63fd45be6f8694262cae903ce5ace0cdcdde3b3513fe1a7184279ebcb

  • SHA512

    398639d1c3903bd5a4632d0b351bc5eff15e514a8a8079720cfedd03d0a10515789d0e9365893b9d824e0098d309d445bc86457bebeb281513c635f6d62f41d5

  • SSDEEP

    12288:WsT2WA+TrTnVCtFE5MXcuDV7sfYafRUQLWPX:WsB7kg5MsS7sRaQLWPX

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b.exe

    • Size

      499KB

    • MD5

      ffa979499187908e3abd52a5eb23ba98

    • SHA1

      313c4451e3e5473732c9b2cef7c943060a91f452

    • SHA256

      1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b

    • SHA512

      1861e3b2593934611181c71c31d2237bb8df839d555f003e8b4110a9d1ab4612180fd59af97349be0cf416a2e7fc455f7f39e62f4785deb2c94bc503985ed31f

    • SSDEEP

      12288:/Ysz65It6fQFY4LvtsnEdCBl5cll3rVLDHqFS:/YszDt6fQnGnGWilt5DHqFS

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks