General

  • Target

    60d4e7791158258a1c7a50570021acb3

  • Size

    1.2MB

  • Sample

    240116-zg141sbbf8

  • MD5

    60d4e7791158258a1c7a50570021acb3

  • SHA1

    107cbdad79622f6112f4d5eaa2319ea85fa97a9f

  • SHA256

    5376e7e271739ec94123ba33b4061ace8309950174746e962c8bade29b571984

  • SHA512

    6f8f6ad7ea17b8b4af31c013ee14272b2cdd6babf5c7775adbeccd9c9fb047a55ab75d8a46d69efc7826909d367ed9558aacf9195e2cf29a3eccbb71101902ce

  • SSDEEP

    24576:HtImRbYyYAu/5LqBsskWKKIfga1HF/KPLGg3SknffSLexizH6ZQKxO5fLXBVmby+:9Jpv2qB/ku0T/Kyg3SEfjIzgQP9LXBYZ

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @@@@@@

Targets

    • Target

      60d4e7791158258a1c7a50570021acb3

    • Size

      1.2MB

    • MD5

      60d4e7791158258a1c7a50570021acb3

    • SHA1

      107cbdad79622f6112f4d5eaa2319ea85fa97a9f

    • SHA256

      5376e7e271739ec94123ba33b4061ace8309950174746e962c8bade29b571984

    • SHA512

      6f8f6ad7ea17b8b4af31c013ee14272b2cdd6babf5c7775adbeccd9c9fb047a55ab75d8a46d69efc7826909d367ed9558aacf9195e2cf29a3eccbb71101902ce

    • SSDEEP

      24576:HtImRbYyYAu/5LqBsskWKKIfga1HF/KPLGg3SknffSLexizH6ZQKxO5fLXBVmby+:9Jpv2qB/ku0T/Kyg3SEfjIzgQP9LXBYZ

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    • BluStealer

      A Modular information stealer written in Visual Basic.

    • A310logger Executable

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks