Overview

overview

10

Static

static

3

391d8025eb...18.exe

windows7-x64

10

391d8025eb...18.exe

windows10-2004-x64

7

$PLUGINSDIR/jzmc.dll

windows7-x64

10

$PLUGINSDIR/jzmc.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    391d8025ebeb784e53f76c6536aa6fe6_JaffaCakes118
  • Size 432KB
  • Sample240711-pnqlrayelf
  • SHA256 3a400fbdc47f573a48a5f3052b0b4e67614b27607232dc448d11acf15b6baf8e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
blustealerstealer

Malware Config

Extracted

Family

  • blustealer

C2

  • https://api.telegram.org/bot1838876767:AAEiDKTcT_A4WBwpMo9nnrtBP7OvsmEUnNU/sendMessage?chat_id=1300181783

Targets

    • Target
      391d8025ebeb784e53f76c6536aa6fe6_JaffaCakes118
    • Size 432KB
    • SHA256 3a400fbdc47f573a48a5f3052b0b4e67614b27607232dc448d11acf15b6baf8e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    blustealerstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/jzmc.dll
    • Size 18KB
    • SHA256 7401f524da5c86ef8d102c6b3196e4eec962a32883bcc74b5a1ecaa1ae2a7a6d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    blustealerstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks