Extracted

• • Target

    1200-140-0x0000000000400000-0x0000000000654000-memory.dmp

  • Size

    2.3MB

  • MD5

    2a67b3a60052a5c4a7f5a799feb3e95a

  • SHA1

    632f937a310a689f8cc71dad111a6a0074486646

  • SHA256

    d7604717f253c708b811bbc895b9baeb3f9060161bfcfc7791e42855ac3f1927

  • SHA512

    cdc3fbefdce5c55855ca8c1d3a0e08d49430d518ad01812636b84dbd97835ef528422dde80459f14f24113f4c482ae599a6db2a88990aeb291d15d935d80785b

  • SSDEEP

    24576:pxgsRftD0C2nKGH0Djsf9nz4mloFQnpXUMPQDR6q79dA:paSftDnGUDYf5zaCpXxPuR6E9dA

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2