Extracted

• • Target

    3040-140-0x0000000000400000-0x0000000000654000-memory.dmp

  • Size

    2.3MB

  • MD5

    f02928ac338e079f9392afded9cf036b

  • SHA1

    6044a58728a468376fe00802bc5617bc1cf1f6b1

  • SHA256

    7bd15f22d0da7a1c042f50925778bcb0e8e90397ca578cb1cd2d2cff07c28b97

  • SHA512

    b24aa1acfa14f89ef6945946eec192d34a7fe9ce352f6007bafcfde0860b46403799538a1e4853463afe618bbd40f601ed133fb4bb48aa357a162f302cb9df05

  • SSDEEP

    24576:IxgsRftD0C2nKG80Djsf9nz4mloFQnpXUMPQDR6q79dA:IaSftDnGfDYf5zaCpXxPuR6E9dA

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2