Extracted

• • Target

    b02a63fa9c807c8509341d264e494f99

  • Size

    1.1MB

  • MD5

    b02a63fa9c807c8509341d264e494f99

  • SHA1

    dd9a5cfc7dbe769be5a9edb8f1e6e1a5e17bf8ec

  • SHA256

    967f7296fc850d9a5c810776f910b5ac22dbff3a31f00c7641bdb68b421b7caf

  • SHA512

    e46f85a067aefb3e500e448aec1d878e8cb79f009f3d434e3f25240fc3d50d41ded7abb18845eedcaa03e00f58078a36a4c258ec8bcfdc9fd8f7668dbe3c6b22

  • SSDEEP

    24576:Z/FAjZ1EVMqHj1q0oc163Dwlrp9KyxsuM:YZ1EBHBqakDwlrbKCs

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2