Extracted

• • Target

    Shipment invoice.exe

  • Size

    1.4MB

  • MD5

    eaad3c08a1f393d748dd5e1a615b2b3d

  • SHA1

    84a3f6c915201d6a662ad227114754aea6c2ee2c

  • SHA256

    e6b2f93e2124fa13a05e54b0f0f9327ccdcebc38ee774332c22f34bf60771cef

  • SHA512

    2090e33e11e3a0ec15052b4c1f32574da80786655f22c766046c536dd47f9b2608279a9562d5cf5107a1a28b0ce78dc0a13c934643919f067c8f6a89b3db489a

  • SSDEEP

    24576:vzOB9fWDrP3eS3OzAMgzZba9W4tL40ze2mLpNPT8EWAinrixydMvD:vzOB9fW33ekxXzZba9W4tzeJeEWPiqM

  Score

  10^/10

  blustealercollectionstealerspyware

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2