Extracted

• • Target

    PurchaseOrder202319876.exe

  • Size

    1.5MB

  • MD5

    a838a2013c038b3a5039cb9abb199922

  • SHA1

    6a315d36c940cd95359cd4ef46c5688352a22a42

  • SHA256

    d4f62b8520f3f0e84b19769be0f7bcdc20e41af8cea048261f3e37c0428b22d7

  • SHA512

    8b80c742b598d0df74e5d7b57e5ceb386d74531572a41b02614651ef9f914367e00ef23c12548f9009500af8ca9d6085406d417fc405f6ca528222a77ea83cbe

  • SSDEEP

    24576:Bq3UElwshsKgvyH1kz7iQ2Py9so+4XfbqQtTpSrwCDCSD85vvOn2rRAJdqfcd7AH:Q3UElf6Lk1y7iSFd5BvWn2WJdyk8P

  Score

  10^/10

  blustealercollectionstealerspyware

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2