General

  • Target

    Requestforquotation.exe.bin

  • Size

    890KB

  • Sample

    230505-zqy11sgf8s

  • MD5

    e0236718f5d4d70c2dc485d322834897

  • SHA1

    f0276ffdd801d3440918269f5d880f0502bda55e

  • SHA256

    5923a0d6ac3cd029ce06706021aaaff83c55193a23c2d5fedd5b3cdd0065b081

  • SHA512

    a7fae05a2aeb61acac13e682dcbff7bd000ecbb0ebc1350a62e528bc6abffe94db1e0cc0b71fa0b6cb90479e666b71dfa7406b8aeddff0bd9490d556a2fdc553

  • SSDEEP

    24576:b4QWOM4PEXi53mZbPovZuFeBwEtumDDd+c6UcqK:b4QWV4Eq3mavEeBwEtfZ+cfcn

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      Requestforquotation.exe.bin

    • Size

      890KB

    • MD5

      e0236718f5d4d70c2dc485d322834897

    • SHA1

      f0276ffdd801d3440918269f5d880f0502bda55e

    • SHA256

      5923a0d6ac3cd029ce06706021aaaff83c55193a23c2d5fedd5b3cdd0065b081

    • SHA512

      a7fae05a2aeb61acac13e682dcbff7bd000ecbb0ebc1350a62e528bc6abffe94db1e0cc0b71fa0b6cb90479e666b71dfa7406b8aeddff0bd9490d556a2fdc553

    • SSDEEP

      24576:b4QWOM4PEXi53mZbPovZuFeBwEtumDDd+c6UcqK:b4QWV4Eq3mavEeBwEtfZ+cfcn

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks