Overview

overview

10

Static

static

3

Purchase Order.exe

windows7-x64

10

Purchase Order.exe

windows10-1703-x64

10

Purchase Order.exe

windows10-2004-x64

10

Resubmissions

12-05-2023 14:28

230512-rtgxxadd83 10

12-05-2023 14:17

230512-rlq6lsfe9y 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order.gz

  • Size

    1.3MB

  • Sample

    230512-rtgxxadd83

  • MD5

    a5c16a16226698844fae06b702d7cd16

  • SHA1

    51f3529f2f4972f2f8bd96301215b151d1b1ff2b

  • SHA256

    3ed0594f9fef04feeaec1abc8f1ad0b85c75df614ba09377e394321ccb16e586

  • SHA512

    1688f54f7f912a37cb1790521bedde93ff684f6abe9cd20f1a2cebd63562c39bb2df645eb94575fa0af3fc969a061ae5acb51285f2239071a04131de71155e65

  • SSDEEP

    24576:M/Mel28gvSgwDFgx4V3/vNsOz6xE4Jj01FbrFsqRVEF3sMnKT4wAQ:MUel28qSgw5gyHyC4Jj01HxbEFcMnFw7

Score
10/10
blustealercollectionspywarestealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      Purchase Order.exe

    • Size

      1.4MB

    • MD5

      98ac95047944a90076ed642f2b56fc7f

    • SHA1

      e34b95acbdbead3a7057f6e42673bed24aa573c9

    • SHA256

      421845b1fbf3828e4f4fe3e7147f501a422bd6ae755e388a089c67d005770b58

    • SHA512

      8d415d64193df913602752c3004a7a24d7bc0ab29129eda9a1e9653e7cbfbaccb5ada7a1aa4a8b4ea81ff7fc2696fea242caf722e655b43f41cdc952738c5f74

    • SSDEEP

      24576:N8whh2b5/1L3Y5zhzKSYIb34DSNCZlk0pRIIV6Kkcd4UiivgEvyV1jBSH:w91Lo5zgSYUI24ZlkwRI+9WUiiv7vyX0

    Score
    10/10
    blustealercollectionspywarestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v6

Tasks