Extracted

• • Target

    tmpvr2meydm

  • Size

    1.4MB

  • MD5

    1dab5e05ac3651db47b6f881dab8dd3e

  • SHA1

    66c37ab30dc83b3519815b2406cc6dd332e4d91b

  • SHA256

    b445018afa2dee3bda17e65e52a7a3c143b0ae31abd00d26f58a4fa3319dd523

  • SHA512

    dd31a50b54385b3c1917e6eb17e7970c2fd97ec481c297865d7f37c7f2ea137ed8b60a131e7de5a7eee2278f5d26951c9da0be4e2babb00582993fb1cf8b4472

  • SSDEEP

    24576:t9j0kMtM5Gcc59B40fuI3At9NzS1f8iGiEKjOWVQbHnERMJaICUQqi+4P8mHMC9i:7MOqu0fpAt9NzAEi7XxsERNB5PRsYo

  Score

  10^/10

  blustealercollectionstealerspyware

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2