Extracted

• • Target

    3672-141-0x0000000000400000-0x0000000000654000-memory.dmp

  • Size

    2.3MB

  • MD5

    6783471e10d1b22dcbb48cbe9f4acced

  • SHA1

    a56ab8039d071669d61ff00922977bc26f40262e

  • SHA256

    b55e703ad7e1fdeb72bd2f622a679246caf8a66115aa99b100fa7770704e0c7b

  • SHA512

    eb3885755da41a308bf177880f546b52baa3c8f87756d89044b87b7eb6f880f2395381ef11ad345057569ea7dc10d8bb340f9a8879791d86e060849e1ad8a3dc

  • SSDEEP

    24576:7xgsRftD0C2nKGz0Djsf9nz4mloFQnpXUMPQDR6q79dA:7aSftDnGgDYf5zaCpXxPuR6E9dA

  Score

  10^/10

  blustealercollectionstealerspyware

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2