Overview

overview

10

Static

static

3

efc2c0eccf...18.exe

windows7-x64

10

efc2c0eccf...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efc2c0eccf8fd4b292db073994c9e6a6_JaffaCakes118

  • Size

    1.0MB

  • Sample

    240414-3f4qasbd2y

  • MD5

    efc2c0eccf8fd4b292db073994c9e6a6

  • SHA1

    e2f77c5b7ba789de2c0306d4add1a8e52ec9ad66

  • SHA256

    fc3325548497708c387234e5c4e1457c3a46bc7061e272c1c35c4668d42a776f

  • SHA512

    00c25aaf34f88a49c3fbe40436feb39259f2cbfdf0d6f86b562f537bb609203fe8aa1b6e6300dd733b8dab8c15f7dd3efbc6ce7e5119a0560b6a6a8eca1459da

  • SSDEEP

    12288:lBB8sZwguPWVA8FU+TrEjD+Nsb3VTu6aYlVfouDjawItin9:RwgucnEjD+mbFi6Hfnsti

Score
10/10
blustealerstealer

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:     smtp
  • Host:
    mail.sevkatvinc.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Sevkat8520.,

Targets

    • Target

      efc2c0eccf8fd4b292db073994c9e6a6_JaffaCakes118

    • Size

      1.0MB

    • MD5

      efc2c0eccf8fd4b292db073994c9e6a6

    • SHA1

      e2f77c5b7ba789de2c0306d4add1a8e52ec9ad66

    • SHA256

      fc3325548497708c387234e5c4e1457c3a46bc7061e272c1c35c4668d42a776f

    • SHA512

      00c25aaf34f88a49c3fbe40436feb39259f2cbfdf0d6f86b562f537bb609203fe8aa1b6e6300dd733b8dab8c15f7dd3efbc6ce7e5119a0560b6a6a8eca1459da

    • SSDEEP

      12288:lBB8sZwguPWVA8FU+TrEjD+Nsb3VTu6aYlVfouDjawItin9:RwgucnEjD+mbFi6Hfnsti

    Score
    10/10
    blustealerstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks