blustealer | 8d34a012165298f1e02dda3d83b863b3468b4ab5c7edda0f88765ccb3460a629

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 12:19

Target
1496-63-0x0000000000400000-0x0000000000654000-memory.exe
Size 2.3MB
Sample240305-phfjlafc82
SHA256 8d34a012165298f1e02dda3d83b863b3468b4ab5c7edda0f88765ccb3460a629
MD5 1faabaa99cb79de147e601c8f8a67c1e
SHA1 390f7270163e6a9ae26e7488606b42f00bf45af5
SHA512 3db77ee481efab33c40c14d2039c58ab772ac152a8c6e72950c84a620f052e96808e80461fb47051945b3f6ffa4888263a743004405fc80dfdc76586f50613bf
SSDEEP 12288:hWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:+xgsRftD0C2nKG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
648	2380	WerFault.exe	93

C:\Users\Admin\AppData\Local\Temp\1496-63-0x0000000000400000-0x0000000000654000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1496-63-0x0000000000400000-0x0000000000654000-memory.exe"
1⤵
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 408
  2⤵
  - Program crash
  PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2380 -ip 2380
1⤵
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3864 --field-trial-handle=3136,i,3192284747741020952,1225278682167953346,262144 --variations-seed-version /prefetch:8
1⤵
PID:732

memory/2380-0-0x0000000000400000-0x0000000000654000-memory.dmp

Download

memory/2380-1-0x0000000000400000-0x0000000000654000-memory.dmp

Download