General

  • Target

    b5145ccf5ded090001d3a5368ad32b5b4853f1b2153e55beae9ff0ba543e449e.exe

  • Size

    992KB

  • Sample

    230608-pmq6wsfc65

  • MD5

    84bcb19b24fb3cf44188d8ea5e8a080f

  • SHA1

    f6a1b91c039a3ce6cff9bf160725a4d2dae6df81

  • SHA256

    b5145ccf5ded090001d3a5368ad32b5b4853f1b2153e55beae9ff0ba543e449e

  • SHA512

    03658af693ef7d3754277e506e0aaf71402ab675ea4618adee8dcd34c50e1e49e5349dd6e92d6dd02f5abb72feb76d97aace506a6fc16f9ce01f1ad1f8902e32

  • SSDEEP

    24576:8qPLaVUH999QYDtn9pvEni933gMciIX0GJ/llyoWD/H:fBH9QYDvpvwXMcpX0GJ/llQ

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      b5145ccf5ded090001d3a5368ad32b5b4853f1b2153e55beae9ff0ba543e449e.exe

    • Size

      992KB

    • MD5

      84bcb19b24fb3cf44188d8ea5e8a080f

    • SHA1

      f6a1b91c039a3ce6cff9bf160725a4d2dae6df81

    • SHA256

      b5145ccf5ded090001d3a5368ad32b5b4853f1b2153e55beae9ff0ba543e449e

    • SHA512

      03658af693ef7d3754277e506e0aaf71402ab675ea4618adee8dcd34c50e1e49e5349dd6e92d6dd02f5abb72feb76d97aace506a6fc16f9ce01f1ad1f8902e32

    • SSDEEP

      24576:8qPLaVUH999QYDtn9pvEni933gMciIX0GJ/llyoWD/H:fBH9QYDvpvwXMcpX0GJ/llQ

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks