Overview

overview

10

Static

static

3

3752671d8e...f4.exe

windows7-x64

10

3752671d8e...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    962b447996d774bd6b11a221ab39bd8f.bin

  • Size

    878KB

  • Sample

    230720-cbwwsacf81

  • MD5

    3048a30b329a666786a214a827d9a0b3

  • SHA1

    8fa1955487896e98f190bbe45d40d34356ad36c3

  • SHA256

    0e1a62a6d3c082384e1fe0957ac7fa8734c5a52e47c20717ca19c46681ed7c04

  • SHA512

    dfb22ebab3e967873c423778446cd6185fa7e71faf958caa2e5faa3b6ecc0f50748103be6a96bae33549aebddd9ffac81f3f20ad1546683a46feb16945ce3b9b

  • SSDEEP

    12288:DRuPqLVH9RaQv3oDicjAvxb36XGFKvuToA5uBl37YX92SL25FAI8q69foyA3TDHH:IUgWcjApbwBSoAmlkt2S66fW3vHUG

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot6120911772:AAEvnEDbWRlbIuD1NP8MtmiY3tQ46T9SQyo/sendMessage?chat_id=6082430866

Targets

    • Target

      3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4.exe

    • Size

      1.0MB

    • MD5

      962b447996d774bd6b11a221ab39bd8f

    • SHA1

      aae4d7117ce9f6c493ed6f7c4d41cbc7c4f805f6

    • SHA256

      3752671d8ecafe3de17f8ec3a30ef23f137d8c3cd62683a13f6e9a56db5db4f4

    • SHA512

      23fbaf09f2e267883ed3e7db9c5f6f1512d2d2ca1ac097b23c3fb7183c7991e7c6b1397448ea996a1d24be6b16b3cc2a4b2d70fdb7c23249918d48923535df8e

    • SSDEEP

      24576:8GFKCcW9RoTHfzW/ZOaXxLvppk/suw0kIrhDhq12N3nCAIQ9:8G8CcW9RoT/a/YahLR2/9Yeh220A

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks