General

  • Target

    1fd4f4c853506d7c826da1ff97789011981c3d41a4bed8d300cf32b3cb7afde8

  • Size

    428KB

  • Sample

    230607-pfx1vsac32

  • MD5

    f77a40d5f587afc009cb42e780046460

  • SHA1

    ad58cf0b1abf1612789d390ce041688274dd7e69

  • SHA256

    1fd4f4c853506d7c826da1ff97789011981c3d41a4bed8d300cf32b3cb7afde8

  • SHA512

    9cbf43bf1c4d7f208e38b989c8bb61a9c2f1a746206f42b8df5882cb60ee3e240f5265ca584e4f3388d51c403d6089ad7b76546b9ee36611575d007fd5a2d0c6

  • SSDEEP

    12288:PWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:oxgsRftD0C2nKG

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Targets

    • Target

      1fd4f4c853506d7c826da1ff97789011981c3d41a4bed8d300cf32b3cb7afde8

    • Size

      428KB

    • MD5

      f77a40d5f587afc009cb42e780046460

    • SHA1

      ad58cf0b1abf1612789d390ce041688274dd7e69

    • SHA256

      1fd4f4c853506d7c826da1ff97789011981c3d41a4bed8d300cf32b3cb7afde8

    • SHA512

      9cbf43bf1c4d7f208e38b989c8bb61a9c2f1a746206f42b8df5882cb60ee3e240f5265ca584e4f3388d51c403d6089ad7b76546b9ee36611575d007fd5a2d0c6

    • SSDEEP

      12288:PWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:oxgsRftD0C2nKG

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks