General

  • Target

    1192-63-0x0000000000400000-0x0000000000654000-memory.dmp

  • Size

    2.3MB

  • MD5

    822b7dec3160249a30842c547ab13cc6

  • SHA1

    a8440364e9607f02b3ac6aac29fcc594d5d01999

  • SHA256

    a54d904e632d445b79af64ea0f2abbcdcd7283e27ff2ca92fe580e178144bc29

  • SHA512

    bb2946f740bca8a6bb2b0d13f9ef50343e4c72a50a8470b46c09da803a51bfa9be776a51c1d039efd5abbdc853cc2439aa34221ab2874a64374a45bd85ca4507

  • SSDEEP

    12288:4WnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:LxgsRftD0C2nKG

Score
10/10

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

  • Blustealer family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1192-63-0x0000000000400000-0x0000000000654000-memory.dmp
    .exe windows:4 windows x86 arch:x86

    df8fbcbe90e1e305a660f0ac2aa4fae4


    Headers

    Imports

    Sections