Overview

overview

10

Static

static

3

693c258cb5...cb.exe

windows7-x64

10

693c258cb5...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ebf99fc11603d1ec4706b4330761df32.bin

  • Size

    1.4MB

  • Sample

    230507-ck246aec6s

  • MD5

    b689ed63ec95ade14a10bb198b171200

  • SHA1

    7f9e14f7fd125f5c0babc89d0fda5375c835697d

  • SHA256

    07d820312855a56e9165f5986195914a6c5986f8d185eac057f8d2b15a5ce9b2

  • SHA512

    bbf0badf2461363e4ae8b35a7ae6fc528b7f3c9155ecd481d6ef3a59d4624a46435a4b4805f12b8a5851337ea500c302f04b2452d5eec4172d229f3bc82191a6

  • SSDEEP

    24576:eogwzVxMBmScc0WL9eWNcnEpO/HdL0XictkWDH9Tzid3snoc41L2kAZYKU2/pmf0:Ow0BmSlLB8EkHGtkedT04Og/l

Score
10/10
blustealercollectionspywarestealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb.exe

    • Size

      1.5MB

    • MD5

      ebf99fc11603d1ec4706b4330761df32

    • SHA1

      c560ca5ae10593d7861701654d839d1071515866

    • SHA256

      693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb

    • SHA512

      d31c699f201343bd02c07bbf5d41e00df8368b81bfbb1d037fb4b1e1894fd3b8232e80b065845745fa6dab7f23d47efbb1d8b6a9143f5b7db0fb4a57395c4f4a

    • SSDEEP

      49152:NQh9Nn3uFcWIY2YZGIUtNlMpovD2i9c2:0/37Wp2YPUtNlMG7N

    Score
    10/10
    blustealerstealercollectionspyware

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks