Extracted

• • Target

    d50e53128afae84f81f41fce22e7ce3f13442485d7c7ce3bb1417afaba6c9c05.exe

  • Size

    2.4MB

  • MD5

    888a18230e69a8ba0c420042bcb6e758

  • SHA1

    0b0dcb23577efc327acdd2ff052bb3d54693d715

  • SHA256

    d50e53128afae84f81f41fce22e7ce3f13442485d7c7ce3bb1417afaba6c9c05

  • SHA512

    d20488366904fda6dccb6a92c4ad0bfc74d2c74702e2f4cadef197cdf1e3f37cd39f3b35a8df9bfc8d3f9a71bfb4fefa6adf0b5f4b8f4cf8eb017367847fd3cc

  • SSDEEP

    24576:sE9iqdFA3SA2PWRLxlTP0q0prBMsOZORHJd5SbyBRJ4y4c2TsdZh8FzxZ+hLAwKu:79vgIWRbb0RtYQBXhcOatvd4oS

  Score

  10^/10

  persistenceblustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2