Overview

overview

10

Static

static

3

60d4e77911...b3.exe

windows7-x64

1

60d4e77911...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    60d4e7791158258a1c7a50570021acb3

  • Size

    1.2MB

  • Sample

    240116-zg141sbbf8

  • MD5

    60d4e7791158258a1c7a50570021acb3

  • SHA1

    107cbdad79622f6112f4d5eaa2319ea85fa97a9f

  • SHA256

    5376e7e271739ec94123ba33b4061ace8309950174746e962c8bade29b571984

  • SHA512

    6f8f6ad7ea17b8b4af31c013ee14272b2cdd6babf5c7775adbeccd9c9fb047a55ab75d8a46d69efc7826909d367ed9558aacf9195e2cf29a3eccbb71101902ce

  • SSDEEP

    24576:HtImRbYyYAu/5LqBsskWKKIfga1HF/KPLGg3SknffSLexizH6ZQKxO5fLXBVmby+:9Jpv2qB/ku0T/Kyg3SEfjIzgQP9LXBYZ

Score
10/10
a310loggerblustealercollectionspywarestealer

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:     smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    sales1@midombo.com
  • Password:
    @@@@@@

Targets

    • Target

      60d4e7791158258a1c7a50570021acb3

    • Size

      1.2MB

    • MD5

      60d4e7791158258a1c7a50570021acb3

    • SHA1

      107cbdad79622f6112f4d5eaa2319ea85fa97a9f

    • SHA256

      5376e7e271739ec94123ba33b4061ace8309950174746e962c8bade29b571984

    • SHA512

      6f8f6ad7ea17b8b4af31c013ee14272b2cdd6babf5c7775adbeccd9c9fb047a55ab75d8a46d69efc7826909d367ed9558aacf9195e2cf29a3eccbb71101902ce

    • SSDEEP

      24576:HtImRbYyYAu/5LqBsskWKKIfga1HF/KPLGg3SknffSLexizH6ZQKxO5fLXBVmby+:9Jpv2qB/ku0T/Kyg3SEfjIzgQP9LXBYZ

    Score
    10/10
    a310loggerblustealercollectionspywarestealer

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

      stealerspywarea310logger

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • A310logger Executable

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks