Overview

overview

10

Static

static

3

479de94fba...e5.exe

windows7-x64

10

479de94fba...e5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    479de94fbadd83fce799ed3389da1ce5

  • Size

    718KB

  • Sample

    240107-bcwrqscgc4

  • MD5

    479de94fbadd83fce799ed3389da1ce5

  • SHA1

    4ae4c57faeab4e3b4cbf07f34c0cb12f542bc422

  • SHA256

    1c29ee414b011a411db774015a98a8970bf90c3475f91f7547a16a8946cd5a81

  • SHA512

    ca9aa4a42e762c430713ead37dddba74f1dac806cdf9282c3a06a6632c2f0e3e22d5754c989fdd743fa5df0ae26bb99179faf08da3c1d5735d6bed7826842e0f

  • SSDEEP

    12288:qlALj79bDcDn7T9mWM+QirAsLyjgeUhDlhcfK56bKIy6Sa5iWK21lm2NRm05g6F:WAvhDcDVMGrAsLmbtfdbOl8R9/

Score
10/10
blustealerzgratpersistenceratstealer

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:     smtp
  • Host:
    netjul.club
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    5nBQc2~lJyET

Targets

    • Target

      479de94fbadd83fce799ed3389da1ce5

    • Size

      718KB

    • MD5

      479de94fbadd83fce799ed3389da1ce5

    • SHA1

      4ae4c57faeab4e3b4cbf07f34c0cb12f542bc422

    • SHA256

      1c29ee414b011a411db774015a98a8970bf90c3475f91f7547a16a8946cd5a81

    • SHA512

      ca9aa4a42e762c430713ead37dddba74f1dac806cdf9282c3a06a6632c2f0e3e22d5754c989fdd743fa5df0ae26bb99179faf08da3c1d5735d6bed7826842e0f

    • SSDEEP

      12288:qlALj79bDcDn7T9mWM+QirAsLyjgeUhDlhcfK56bKIy6Sa5iWK21lm2NRm05g6F:WAvhDcDVMGrAsLmbtfdbOl8R9/

    Score
    10/10
    blustealerzgratpersistenceratstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks