Extracted

• • Target

    18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043.exe

  • Size

    1.5MB

  • MD5

    581f51fd35e943a69a4c569fa8654736

  • SHA1

    610e7579a996ea788ccb688a9dda9d4855a40a2d

  • SHA256

    18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043

  • SHA512

    8bb8ce0f096c5a08e2457c7039f0169ae312f850e8189e240176e7a4ccf4ba113efe9f3a19e4e282ff66b60e48b0e07127270da804e0192f5ef091f7ea9e03db

  • SSDEEP

    24576:Xbj8B+M73OglQfGmzu7SulbydbwcLxTDkU9tMMkB5lO2dMqtX1uP:XX++tglKKPwbwcLh4otmB7ldMg1C

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2