Overview

overview

10

Static

static

1

5c11c170ec...9f.exe

windows7-x64

10

5c11c170ec...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec7c37ae9c0377f3240a274290c9c214.bin

  • Size

    995KB

  • Sample

    230329-b89y8sec86

  • MD5

    3675654d80a2df93ce6f3c796fa7e103

  • SHA1

    4432cd176cabf10ccf12348cdda9f7e763d829aa

  • SHA256

    e062710d9f3f47ef33753d6fb236352da9bca3857dfbb94980d86f3843abec09

  • SHA512

    1f0de1ff079b57e6391abbf015878f1f82af5dbb73555669af427da7a9650a18f42b4d11da46f870b2ba83ed4c1039e825ed7dca010c9d5b4d4100833333c6c1

  • SSDEEP

    24576:a19gJribp77upLNnLzpNbGAg6faEyFQELi4vojS5vDx:Pxi7iNnXPbxJyF/+4cS5bx

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5916787654:AAEJEadEk6VSBHL82vTGRS9aaNuh-zG53Rg/sendMessage?chat_id=5483672364

Targets

    • Target

      5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe

    • Size

      1.1MB

    • MD5

      ec7c37ae9c0377f3240a274290c9c214

    • SHA1

      432915cb9e9e860a84e142719bf0e82392c69a6a

    • SHA256

      5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f

    • SHA512

      326f282eb2a8c6f79de6f7019fc7d16be88345467301bc1d28c36f5c7094ac38ec206dc068d24c8bcecd0cb02e39af1d5070f839f9518f0e8e149ac5c5c0c576

    • SSDEEP

      24576:KZUu39V1vMSb4gz1o5Ti81zSdyrjLDjFPR6KrXmTDa:yltsSkW1o5Tiouy/z6KrXmX

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks