Blue Stealer.zip
- SHA256 d0c9a02a815aeecb435e78a7066c0e40c1d2b3af159ec2969333049ceec8ee7f
Behavioral task
behavioral1
Sample
Blue Stealer.zip
Resource
win11-20240412-en
windows11-21h2-x64
38 signatures
300 seconds
General
- Target Blue Stealer.zip
- Size 6.8MB
- Sample240424-the1aach68
- SHA256 d0c9a02a815aeecb435e78a7066c0e40c1d2b3af159ec2969333049ceec8ee7f
- MD5 75995fde46a5836b53051bb8c8555691
- SHA1 c551d6fd55994fd92dfc9faf90004417ec4618fc
- SHA512 93cd0d0e725395277bd40d9a4a7d89fe2374914ec374d9fbc9ab87c9907cf35fdb907a8b3278338252b6bca452d1c99143c94c9184ffc6dc2d7fcb0bea649c02
- SSDEEP 196608:RHDxpP9lDZ4SM8Y1VIif7a2mz89lUUT1KE8X:Rj3LDZU8UGaa2m44UC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
library-waiting.gl.at.ply.gg:13302
Attributes
-
Install_directory
%AppData%
-
install_file
Windows Helper.exe
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/Blue Stealer/Blue Stealer/Blue Stealer.exe family_xworm - StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/Blue Stealer/Blue Stealer/dlls/Recovery.dll family_stormkitty - Stormkitty family
- Xworm family
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/Blue Stealer/Blue Stealer/Blue Stealer.exe unpack001/Blue Stealer/Blue Stealer/RVGLib.dll unpack001/Blue Stealer/Blue Stealer/SimpleObfuscator.dll unpack001/Blue Stealer/Blue Stealer/dlls/All-In-One.dll unpack001/Blue Stealer/Blue Stealer/dlls/Informations.dll unpack001/Blue Stealer/Blue Stealer/dlls/Keylogger.dll unpack001/Blue Stealer/Blue Stealer/dlls/Recovery.dll unpack001/Blue Stealer/Blue Stealer/dlls/Stealer.dll
File Explorer
-
Blue Stealer.zip.zip 6.8MB
-
Blue Stealer/Blue Stealer/Blue Stealer.exe.exe 123KB
-
Blue Stealer/Blue Stealer/RVGLib.dll.dll 241KB
-
Blue Stealer/Blue Stealer/SimpleObfuscator.dll.dll 1.4MB
-
Blue Stealer/Blue Stealer/dlls/All-In-One.dll.dll 4.8MB
-
Blue Stealer/Blue Stealer/dlls/Informations.dll.dll 22KB
-
Blue Stealer/Blue Stealer/dlls/Keylogger.dll.dll 17KB
-
Blue Stealer/Blue Stealer/dlls/Recovery.dll.dll 1.1MB
-
Blue Stealer/Blue Stealer/dlls/Stealer.dll.dll 3.3MB
Blue Stealer/Blue Stealer/Blue Stealer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c102d205cf0735aafe35459abcf49ee1aa26d4ea48e2c55df663d17a3dca5cae
- MD5 d2f30777b67746305bcfa4466994765a
- SHA1 d51a8ed9c151e477cc901373d763252f3f738fb2
- SHA512 4e678d6435f62a3a08eb06fedb42a0111be39eedd76b536e1f793dd6a2551f93e1704b2fa8df2b649e02fb16cef4a7f585a2783405573d6fb53bda97c02271aa
- SSDEEP 3072:vAudlvOfgmRQubp7/+wOpTeCaJwRcbuDU6GxfaZd:vAElOHQub9GXRFDuaZ
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
74750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Blue Stealer/Blue Stealer/RVGLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aaf9fb0158bd40ab562a4212c2a795cb40ef6864042dc12f3a2415f2446ba1c7
- MD5 d34c13128c6c7c93af2000a45196df81
- SHA1 664c821c9d2ed234aea31d8b4f17d987e4b386f1
- SHA512 91f4e0e795f359b03595b01cbf29188a2a0b52ab9d64eadd8fb8b3508e417b8c7a70be439940975bf5bdf26493ea161aa45025beb83bc95076ed269e82d39689
- SSDEEP 6144:4vJ05NPsvienBaRWxomAElbgu6Cqe2ZBePW9J:4u6iABa+iu32ne
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
239KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Blue Stealer/Blue Stealer/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Blue Stealer/Blue Stealer/dlls/All-In-One.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e050a91599f3e6a89dc84a4825fdea6c4d66e970472aabf48ff586d79b67898c
- MD5 f24552f5f604c80ba4cf7afd2143df05
- SHA1 98883b7bf9b996c788bb501336e388177b9b19c2
- SHA512 1edb1f6cc4bdb3b69204fa724b2f8a5205b3251f475ae7cf8cb015220a26e9a976c1baa3c938e8fb9df1470795ff579e21b339b58c79f96af96cfdd17eba6c15
- SSDEEP 98304:Vl19F9QORkChiDC9OtH7c2iwGxIvPBOw0JefVfQ2a5cFd4KssODtd:F9FPRkC8C9OH7c2ilInz0kfVo26Wsd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5042578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Blue Stealer/Blue Stealer/dlls/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b10616eb3f5e4b0ceffc696179cdb616c78ef970dedbac10845a39985c91a38a
- MD5 310ba7a07953ed7f783e89bcff6197e3
- SHA1 147aa53e0d7cb027e6c67fa50fcb0dc0c770e157
- SHA512 554ead0f700dd617eed6055a84ecad288c4779ab20206e7434a8f3443a03a95a501014cd52390eb57570c25ea2bd7a298b96e88e8550d10b2a5db4f9633af529
- SSDEEP 384:24svJAz5thUNHcxxypeGQ/0n3TmyxhxJNSLSg4RjjoZ:24suz/LypeGQEjfNSQM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Blue Stealer/Blue Stealer/dlls/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3361bb2309e4ee31f14081bc170ac530e2ae9d1336026e736190a0304e2e77e4
- MD5 40ba99b80654259d0428c7e4f3645948
- SHA1 8fa93e0f035694cd8e420aa2232aca859b3a2a6b
- SHA512 fc1deb29eea114e5a472102a51d49fa253a5c79821acffa930b30089ebecec4312437d4720b46e92149be2ce69aed57dc3939621a596ed6c413397363fa44ee7
- SSDEEP 192:uCK9HKDyS0+NKdUxEIj1aq8fgYO1Lnq4Ur1XneDN6IW1Y6Up91KNN10UbnnSL2CV:K5Oe+4dw1IDMO4U5uD8Upih0yZCV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Blue Stealer/Blue Stealer/dlls/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a81e4efc2c85a4f8fed46b9b0f3bd3c2a750a3047ae7ce5b29f21df52d85dfbb
- MD5 be590ee7d8c0366cc28c200308ba0823
- SHA1 0fa6c6ca44893c45f115e446566f0d4dcf5168d6
- SHA512 cbbb4c62d703bf8dd0e0e34b438401710c1bd62c82f71060483f4a84dfaa802a9b0d39b904d6f77cf4ef0b630f173f66f349497d53a6039c640e0f4301e26041
- SSDEEP 12288:M2uX3iDoOeiWYcW3GFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchk:PNeiWYtc/5/jbOE8ULrFmCCo
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1154746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Blue Stealer/Blue Stealer/dlls/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3257ac3031047fcb719a8f82bd54ce42a6d542a97dd0149da08957a0c479e7fc
- MD5 6cf3156c057817473d7d2239f71d2403
- SHA1 36f45d7a326054e231b77b6021392d35898096ec
- SHA512 3828f10081ef476cce1832ae8b3f68d7efaf539903f9d4f4e6fc4ef19feb87cb2d63409d5057e5d6d4b46e229d9ca10e39917a5c1902c55a3ce01cf18d67526d
- SSDEEP 49152:1VbwgxmbsO2B7wKOfpUL6GbriHeGAb4TkyNejj2SqE08:1VbFxmbsO2B7wKOxfSf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3453418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ