General

  • Target

    RFQ for supply of Stock Replenishment FI-2023-089.exe

  • Size

    833KB

  • Sample

    230419-meszeahh66

  • MD5

    c3d43cf53c510fed679a621e5c9d0aea

  • SHA1

    a8d367631072c110d99369209782f8ddd6de673f

  • SHA256

    2a4fe1060c15849fad34754e02f548fc250f8749ab923f929c7497c0614c760b

  • SHA512

    19d006881997d35cc57fff45b1e216d601d83b15045dcc75f8b6b617bb797c838a7cf0c3e0eec1e016817d5f3f429650a88a914bfaa9b9deeb62af18255437a8

  • SSDEEP

    12288:El4SNuCXLzEfF0S2FXtBvFD3oNQLp1K6YZQ0MASVbNqRPXnBGTJ:EG9CvEfFv23o2LDK6WQOSVpwXnB2

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Targets

    • Target

      RFQ for supply of Stock Replenishment FI-2023-089.exe

    • Size

      833KB

    • MD5

      c3d43cf53c510fed679a621e5c9d0aea

    • SHA1

      a8d367631072c110d99369209782f8ddd6de673f

    • SHA256

      2a4fe1060c15849fad34754e02f548fc250f8749ab923f929c7497c0614c760b

    • SHA512

      19d006881997d35cc57fff45b1e216d601d83b15045dcc75f8b6b617bb797c838a7cf0c3e0eec1e016817d5f3f429650a88a914bfaa9b9deeb62af18255437a8

    • SSDEEP

      12288:El4SNuCXLzEfF0S2FXtBvFD3oNQLp1K6YZQ0MASVbNqRPXnBGTJ:EG9CvEfFv23o2LDK6WQOSVpwXnB2

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks