Extracted

• • Target

    470621f5aef9787e21b629735c1a5f9f

  • Size

    1.3MB

  • MD5

    470621f5aef9787e21b629735c1a5f9f

  • SHA1

    be32079fc5d6662582685689c644322642073778

  • SHA256

    d0b801a4ea3be10c3cf2dfff06e2437c9d96e4cbe5be96483c00a4c10b27d2c5

  • SHA512

    9e321a30ae8d88c13f96033fd63a7a5bb78a35c2bb1edbe02c30109df518c07c54a72f29c3f11c9573943483ac2fb5e273d8ad2054e30458396b5de6f78c534c

  • SSDEEP

    24576:P4S/d3rKzksfks2y8jIGReCFlolhhNxuNeG5Gm+8MN6ZNBZ:TKqYGRzlWoejmcN6ZNB

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2