Extracted

• • Target

    Request for Quotation.exe

  • Size

    1.4MB

  • MD5

    235c2d00b691656b63a715eac1e7511b

  • SHA1

    511e1e3646ad2ca0012709c56544ca9497b969e0

  • SHA256

    374bd46f94cdf56eb2775ec23f0b70e8179541f348de2959a4a885b8f22af99c

  • SHA512

    f0432f5f5668af790b8959a0cdd75236389cc0a3af2c033e04d92066373207d935f7a75261a0e46a9339fc8d083097555ea9a5c6f032310c54c4659dc7913ec3

  • SSDEEP

    24576:AR8UY0b6vrCWFHojNYhS8vE1BiCJQwcGJVdOeyYZ3pnFchs1D3x3PWh:28emvrCmIjNYJv+BxHcGJy+3pnFcWpNP

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2