Extracted

• • Target

    Purchase Order FP2305006.exe

  • Size

    1.6MB

  • MD5

    c7c88b125e27183372fb3d59c959f637

  • SHA1

    47da39de6edee6bbe9680d830e8f64b7f3fccf3a

  • SHA256

    e44e1135888701ba8cbf462efa9d992a2fa1f83e52c471f65c62c16fdecade26

  • SHA512

    f6beaf1a6e4d8fdde08fb44c90f93c75c6f88bf04d35a90de0711a683c4a19cc82f0e846b038af4b30f6e18d5905d6006de5e00dad5cfd629d673dd81015ed63

  • SSDEEP

    24576:04LpeAT/4TUmBmsV7ckan9wLb+mkA2NffoYF2zEg06nLnH8b/5cN:ptADBmsmkanaLb+XJwS2zECLH8bI

  Score

  10^/10

  blustealercollectionstealerspyware

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2