Overview

overview

10

Static

static

1

PO 152421.exe

windows7-x64

10

PO 152421.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b520c3f9254212589ec7da68647cebb4fd8cc2390aa90febf51c76dc8af3985d.zip

  • Size

    486KB

  • Sample

    230321-qp3s5sae59

  • MD5

    e20e8b4027fa928771842c3dbd634dca

  • SHA1

    2b72aca69eb3457208debd9b739354c38b2d47a3

  • SHA256

    34a1b4994ec2ac63920078853c119a1692983a1ad5e3b3b573c30ac5c0eb8f1f

  • SHA512

    7f168b570195808ab8e32905992ed2bcb8855b4e92c3f6d0d483bc57e367b3869030a9270d1b6442bcd48a709b8db3413b2ba6edfcb69c91c5afe84557b70d2e

  • SSDEEP

    12288:PD/q9yW+QyZyuS/D2YBKLcvSfp0GG664HlVfrrOzT5+zgMN:PDeB9CuE9faGGkzrU+zgI

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Targets

    • Target

      PO 152421.exe

    • Size

      501KB

    • MD5

      460bdbbe5a6b8bd3f887c8b6fd4128a2

    • SHA1

      891099bcbf82de10e1b197d2c42b2044dc0bed46

    • SHA256

      58d5286e5694f883d2452a81e5f6e77413292ba388300a6e44dd0f91e217aff1

    • SHA512

      b741e4bc33762adc9dee71f7a348ec9e7615bd4631bb73c39e4d69a01e8d469a3eb1aa303c691e2671aa939c223c6fc4a5bc05b2dea23b40f3e5422e2b4b3c6c

    • SSDEEP

      12288:/YFfpyLOuydXBmm+vie9mUX1NqRBchWc6P0vMLxJRg0ExsOPn7jhPhl9iqo+/:/YFhyCuCoie9nFNqgL6P0vlLxVP7FT93

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks