Extracted

• • Target

    8673653b4e2feb2342836fa526e90d2412ff6f61d77e693efb0172827f45c135.exe

  • Size

    1.5MB

  • MD5

    76a953005611843cca8ba94dc2ffbfcf

  • SHA1

    af634f838961dbeb328c9fb09ab23cb1aca2affe

  • SHA256

    8673653b4e2feb2342836fa526e90d2412ff6f61d77e693efb0172827f45c135

  • SHA512

    06095412d5fe83e4741ab31a4fe890283c0b8b659ea7fc2289dc52e1ed2c07cd8619e8fdbc9368a4980c6e8b43161472d55d96552df2b57759e84c9a85a16a3b

  • SSDEEP

    24576:8r1voTP6JZs4KoxhV2EiP0Av/1IZwA7dTej7Tz5IDuvkuwV7GkeoAu2j7NiznXBy:8r1voTP67sJoxTiP00/OH1eHVSJXT281

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2