Extracted

• • Target

    Purchase Order 202319876.exe

  • Size

    1.7MB

  • MD5

    09338b623f4473341a54191980901783

  • SHA1

    40c8fca01c37d1f1592dacc06f48b918311e37e7

  • SHA256

    f1de1c385fac0c850ee30233c971a76beee78824500899f5c64db03c70ac2e03

  • SHA512

    03da01911a00993ce7ddcd58a3cb6e185389bc341f8b1bde6c287eeca220cf960c690f91d0442b48f812993750d37dc4da4ce86bf6dfc53d00aa9829a31f8fe0

  • SSDEEP

    24576:+b3IBXM8LcvUtY+FGkacy9RjdMD84XKpJKbJ6byq0TyJN8Wo+uOZakN:WQXZcvUtYRcGLoHvJQb8WoIN

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2