Overview

overview

10

Static

static

1

Request Fo...on.exe

windows7-x64

10

Request Fo...on.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c29f0634bb2b57b4bc461099e76a01682a7132a5b679e22e3235453e02fc14ce.zip

  • Size

    488KB

  • Sample

    230321-qp4ensce8z

  • MD5

    a766928dd24b8367fa140c94886ea53f

  • SHA1

    8da8a00fefd0eee1a1330c102850cdbbe4580ddb

  • SHA256

    658c43775d0dfb5029a8b3a3ce9acced56b2f25d069b221f383e606c002fffd5

  • SHA512

    3bc85ba173b7e66614fa32722e2299d39c8cdf7b489d6f8e28a35eecaed641644f04a558d1114f136134d8d6cce4295ff543d1a5fa5b0839101c108e3acdfd35

  • SSDEEP

    12288:6lmKT2awhHpOTiZudV/5V9v8AKn8rgnr6SLBlSUYNHNi:6ljT2agHuJdV/WnnWSLB7Kti

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      Request For Quotation.exe

    • Size

      502KB

    • MD5

      e6759016429ab2d38c9a9497325c5746

    • SHA1

      8d4a9bd427e937d523968d57f8bced231189624e

    • SHA256

      20919ab5a667f7a8ef3d7d1e614f3e448bf875a066ac56c257e2e07878f6e336

    • SHA512

      f266a3958d48efc6a9b105c62eb0cfd8d30e810b3f247e065b9b62a0f62f70642b1964a7d570f22f16a64cd1430cfa25c3de53201282773b1bd0b5ef352485b1

    • SSDEEP

      12288:vYqsd1RU0HAn7av42cnY/jVFIegYLTvEOLhPMuOBmO:vYqsd1DZ42ci7lLTsOBMucmO

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks