General

  • Target

    RFQ-06062023.exe

  • Size

    994KB

  • Sample

    230606-j548kscg48

  • MD5

    9c8ebe5eb36367cf02012d0664b97202

  • SHA1

    e1fdfe7d35e0241eb17e501dce0586f37bef4ac7

  • SHA256

    3c4bb89b988346aaae821e6b5ca65572da9e265bf00dfa5d0df0870634711545

  • SHA512

    2ab235608c6e5d97dcd995a4700b99ba863a47674fe34d4981d469a32ad99d085fdaa72a0eed068f8cce79049ec1f24f93d16de0eb068b7a845c6866d482cf0a

  • SSDEEP

    24576:E/thewlqB6pq4ptiyuo0urd0XAa23zgS4mU3yUt7T6O+uw+:se2q8pFpt91yf6U3D7TX+

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      RFQ-06062023.exe

    • Size

      994KB

    • MD5

      9c8ebe5eb36367cf02012d0664b97202

    • SHA1

      e1fdfe7d35e0241eb17e501dce0586f37bef4ac7

    • SHA256

      3c4bb89b988346aaae821e6b5ca65572da9e265bf00dfa5d0df0870634711545

    • SHA512

      2ab235608c6e5d97dcd995a4700b99ba863a47674fe34d4981d469a32ad99d085fdaa72a0eed068f8cce79049ec1f24f93d16de0eb068b7a845c6866d482cf0a

    • SSDEEP

      24576:E/thewlqB6pq4ptiyuo0urd0XAa23zgS4mU3yUt7T6O+uw+:se2q8pFpt91yf6U3D7TX+

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks