Extracted

• • Target

    QUOTATION _RFQ# 1043999.exe

  • Size

    1.1MB

  • MD5

    761e246fbdde33f37a9bd68fcc8286e7

  • SHA1

    571eea7e2618ab05cb19bef6e9337855321d775c

  • SHA256

    c376fe2391abf98b6da345abfa7ce5d51da5cbcd172423083da3dc83fbb9cdb1

  • SHA512

    fe4ab08a13765c061c30cd3f6dfcbb34960f587b44f231eefcd736790fbe56788b4f1ec04ebf563644628c728d54d13ccd2aa1527cec05db5e3b664363b9f59b

  • SSDEEP

    24576:/YtQ7AZ1RnHQjI9A4/wsf3Iz39pnvgey2UNupVchQXPA3:A1n5e4/wmItpnyJNwV2L

  Score

  10^/10

  blustealercollectionstealerspyware

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2