blustealer | 2552-163-0x0000000000400000-0x0000000000472000-memory[.]dmp

General

Target
2552-163-0x0000000000400000-0x0000000000472000-memory.dmp
Size 456KB
Sample240302-pysh4add3v
SHA256 7123566d71d2fd588fa4a408a7ef476b409d0e74929601c636f1fbc5b5854135
MD5 8f7226104c4d7d8f2370189621507367
SHA1 dedb13ae4dec7788290a73162d7e63ef1e5cc7da
SHA512 9c819032d82e7c177be018a5eb2de7cd968fbc256577562f6523fdc07a546c35a0f415a4ab09b3266f1a47766ab1fc26a547f9679487eef853f52fd8ec1d6644
SSDEEP 12288:TWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmBC:0xgsRftD0C2nKGs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blustealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5813496253:AAF4hamIx4-mNmFF1DwsqdJ4F9vUBmFqLo/sendMessage?chat_id=1105271645

Signatures

Blustealer family
blustealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2552-163-0x0000000000400000-0x0000000000472000-memory.dmp

File Explorer

2552-163-0x0000000000400000-0x0000000000472000-memory.dmp

.exe 456KB

2552-163-0x0000000000400000-0x0000000000472000-memory.dmp

IMPHASH ad800f126b9119e85b22d5a725a65e11
SHA256 7123566d71d2fd588fa4a408a7ef476b409d0e74929601c636f1fbc5b5854135
MD5 8f7226104c4d7d8f2370189621507367
SHA1 dedb13ae4dec7788290a73162d7e63ef1e5cc7da
SHA512 9c819032d82e7c177be018a5eb2de7cd968fbc256577562f6523fdc07a546c35a0f415a4ab09b3266f1a47766ab1fc26a547f9679487eef853f52fd8ec1d6644
SSDEEP 12288:TWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmBC:0xgsRftD0C2nKGs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaStrVarMove __vbaLenBstr __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList ord516 _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat ord660 __vbaSetSystemError __vbaRecDestruct __vbaLenBstrB __vbaHresultCheckObj _adj_fdiv_m32 ord666 ord667 __vbaAryDestruct __vbaLateMemSt ord593 __vbaExitProc __vbaForEachCollObj ord594 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaBoolVar __vbaBoolVarNull _CIsin ord709 ord631 ord632 ord525 __vbaNextEachCollObj __vbaVarZero __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaVarTstEq __vbaAryConstruct2 __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarLateMemSt __vbaFpUI1 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler __vbaPrintFile __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 ord531 __vbaFPException ord532 ord717 __vbaStrVarVal __vbaUbound __vbaGetOwner3 __vbaVarCat ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaNew2 __vbaInStr ord648 ord570 __vbaVar2Vec _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaFreeStrList __vbaDerefAry1 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 ord579 __vbaVarSetVar __vbaAryLock __vbaLateMemCall __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaVarCopy ord616 __vbaFpI4 __vbaVarLateMemCallLd __vbaRecDestructAnsi __vbaLateMemCallLd _CIatan ord618 __vbaStrMove __vbaCastObj __vbaR8IntI4 __vbaStrVarCopy ord619 _allmul _CItan ord546 __vbaAryUnlock _CIexp ord580 __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing