Extracted

• • Target

    PAYMENT SWIFT COPY.exe

  • Size

    1.1MB

  • MD5

    ec7c37ae9c0377f3240a274290c9c214

  • SHA1

    432915cb9e9e860a84e142719bf0e82392c69a6a

  • SHA256

    5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f

  • SHA512

    326f282eb2a8c6f79de6f7019fc7d16be88345467301bc1d28c36f5c7094ac38ec206dc068d24c8bcecd0cb02e39af1d5070f839f9518f0e8e149ac5c5c0c576

  • SSDEEP

    24576:KZUu39V1vMSb4gz1o5Ti81zSdyrjLDjFPR6KrXmTDa:yltsSkW1o5Tiouy/z6KrXmX

  Score

  10^/10

  blustealercollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2