blustealer | 139ab5b62369fcbeba601c850703e5a2214e7a61507c824dc68657f8b94a7caa

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 00:58

Target

78db2e5dca95ef74fea854b17e7508f7.exe
Size

676KB
MD5

78db2e5dca95ef74fea854b17e7508f7
SHA1

63c4613e6d383b7084997de04b5b1d6532368ae3
SHA256

139ab5b62369fcbeba601c850703e5a2214e7a61507c824dc68657f8b94a7caa
SHA512

a76fb2abe901ce78bfcd962ce2076252c86a5763d84e52dedd95ab9f484e54dce706e2e9e78e4b364a15d5b42d0df4bba22902a5668dca34b982cb33866b4479
SSDEEP

12288:b3+RRe9cVVcvk7AvhNpDZWRKdGG0jpRIsgR93:qRRe9cVXAZNrWRjPIsgr3

Score

10^/10

Family

blustealer

https://api.telegram.org/bot1838876767:AAEiDKTcT_A4WBwpMo9nnrtBP7OvsmEUnNU/sendMessage?chat_id=1300181783

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 2476	2508	78db2e5dca95ef74fea854b17e7508f7.exe	29

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2508	78db2e5dca95ef74fea854b17e7508f7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2476	78db2e5dca95ef74fea854b17e7508f7.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2476	2508	78db2e5dca95ef74fea854b17e7508f7.exe	29
PID 2508 wrote to memory of 2476	2508	78db2e5dca95ef74fea854b17e7508f7.exe	29
PID 2508 wrote to memory of 2476	2508	78db2e5dca95ef74fea854b17e7508f7.exe	29
PID 2508 wrote to memory of 2476	2508	78db2e5dca95ef74fea854b17e7508f7.exe	29
PID 2508 wrote to memory of 2476	2508	78db2e5dca95ef74fea854b17e7508f7.exe	29

C:\Users\Admin\AppData\Local\Temp\78db2e5dca95ef74fea854b17e7508f7.exe
"C:\Users\Admin\AppData\Local\Temp\78db2e5dca95ef74fea854b17e7508f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\78db2e5dca95ef74fea854b17e7508f7.exe
  "C:\Users\Admin\AppData\Local\Temp\78db2e5dca95ef74fea854b17e7508f7.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2476

memory/2476-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-5-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-8-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-1-0x0000000000140000-0x0000000000240000-memory.dmp

Filesize
1024KB

Download
memory/2508-3-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download
memory/2508-9-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download