Extracted

• • Target

    BTC PAYMENTSCOPY_____________________________.jpg.exe

  • Size

    743KB

  • MD5

    d5d26738ed73d191556fc5640b43ed39

  • SHA1

    eaec7a86cbe18f9eb5099ca390e43562701f6d29

  • SHA256

    d254826085eaada20b9ab3803fdf88d2326ffcb2e90b36d3fbb129fce1cfed5a

  • SHA512

    475c358c8353daac6efe9212bc649ce22197d38f32e6d63543896f77d420ca50717468e32b92dd975d685ef193624ee96bcac958da6265658748ed483f454529

  • SSDEEP

    12288:I1Wl8T5+M63xjmevfUu+2EYhsJZ2uEYpplNw:IA24dx0Yrmps

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2