Overview

overview

10

Static

static

3

Request fo...on.exe

windows7-x64

10

Request fo...on.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request for Quotation.gz

  • Size

    908KB

  • Sample

    230530-r6rmwaab58

  • MD5

    0f9a317edc1cf9ce7eb1efca4871b91b

  • SHA1

    1c327eb6d2576d6ff04cf25053838809dd34018a

  • SHA256

    6c7f745d0364ab5497cf5a57791ca3b2006c156c2053b00cf04e48976a77a1de

  • SHA512

    3fbee7c2dcbef5ad53c60be91949c979cf54d3abefbc78b97be129667fa740c99db3cf683fd304a21771801186d3c6613d5de4fdb881d7fcf8b6603afa65e5cd

  • SSDEEP

    24576:MSsPkEOnJFKnAGamQqeD29/JhXHB9AmRuxEUyd:M1PkEOJFGapSL3B9AmRuKUW

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      Request for Quotation.exe

    • Size

      1024KB

    • MD5

      a1effb2cfe2a999d25a2f16a3271b0ec

    • SHA1

      68752a3d1b5c2837829f4b1e9d59fa7529d4ed07

    • SHA256

      45c0d4c42e3d98c94d5ae01270b7b0adfe3de2454520fa7b423f0fc9e2f49603

    • SHA512

      6b335e536919c03b69d60aa645642e253cc12aee2ec9396585114870370f25b3ba5994742b6676c770528a718c3af1ceee086bac93d554b6d043dbd6639301a8

    • SSDEEP

      24576:S9LaVUH999wbJG2Bzr7G9Fvqp8vYtY3aoT55ybAt:+BH9w1Havq6vYS34bA

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks