Extracted

• • Target

    fa78d1d0ef30fafdb9670abc29deb24e_JaffaCakes118

  • Size

    915KB

  • MD5

    fa78d1d0ef30fafdb9670abc29deb24e

  • SHA1

    52b8bf6a36b6f4f74718c51c356112368110807f

  • SHA256

    80877119f9ddd3a9f4740e0b04640d3fd1793787cfb9d45cc5f23ed318828b1b

  • SHA512

    f9c96a1f2054ed926b39938594d8051ebe926044a15a3650b6fb9e9766ea50df6bcae4834381378c6959dc4489f86097863c44c5e6cdc0e28be0660e1794b1da

  • SSDEEP

    12288:1FDc9F3nC0Py3gAhgqeJbNo6CBN0bm1acX3x81GzE0ELQ1wBDrUYSi142+y:15bN0RKWgE0mQ1wBfUFy+y

  Score

  10^/10

  blustealercollectionspywarestealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2