Extracted

• • Target

    3816-142-0x0000000000400000-0x0000000000654000-memory.dmp

  • Size

    2.3MB

  • MD5

    28af75842a4a507ed1bc04782133c1cd

  • SHA1

    c0198e76b972772adf04b9a37b575db0e2a1a65e

  • SHA256

    5ab9feae38e3b0f409af2261cdddc44676b301ed4df03adec3bcae88d1fe58da

  • SHA512

    15739906e7041e4fd7e65c90eb65513113bc7356863285a881a932c35223a56e269355a1e00e504f88d2c0dda1817e0850fb0340c855a9efd1b82e0384257590

  • SSDEEP

    24576:wxgsRftD0C2nKGH0Djsf9nz4mloFQnpXUMPQDR6q79dA:waSftDnGUDYf5zaCpXxPuR6E9dA

  Score

  10^/10

  blustealercollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2