Overview

overview

10

Static

static

3

05c083a3ef...18.exe

windows7-x64

10

05c083a3ef...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05c083a3ef66ad69e1ba8ac427ae8897_JaffaCakes118

  • Size

    695KB

  • Sample

    241001-n8836ayckp

  • MD5

    05c083a3ef66ad69e1ba8ac427ae8897

  • SHA1

    78aa9b42981b5f4d466d2ec0aa0fe8d3b6e4d475

  • SHA256

    99a3e2ebd1bc060c20f9d968c9fb58bca75e81a311ac8b9d0fbf7891f725fb53

  • SHA512

    509a7a40f73569af81dbc67b7ce62121f066c9874a8347ac44af268a83a854f359ce0ff3164e6f5b88d7871d3ae9ede7a9157cbefb2e06902ee4bda1dc5cc213

  • SSDEEP

    12288:ayB+7T3wXQZzFkhy0NzP7v8yZPQxZ6Xc0c4mh4C93Wk:yzwQGnHZP+ycdhvR

Score
10/10
blustealerdiscoverypersistencestealer

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:     smtp
  • Host:
    restd.club
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @433u7a~IdTF

Targets

    • Target

      05c083a3ef66ad69e1ba8ac427ae8897_JaffaCakes118

    • Size

      695KB

    • MD5

      05c083a3ef66ad69e1ba8ac427ae8897

    • SHA1

      78aa9b42981b5f4d466d2ec0aa0fe8d3b6e4d475

    • SHA256

      99a3e2ebd1bc060c20f9d968c9fb58bca75e81a311ac8b9d0fbf7891f725fb53

    • SHA512

      509a7a40f73569af81dbc67b7ce62121f066c9874a8347ac44af268a83a854f359ce0ff3164e6f5b88d7871d3ae9ede7a9157cbefb2e06902ee4bda1dc5cc213

    • SSDEEP

      12288:ayB+7T3wXQZzFkhy0NzP7v8yZPQxZ6Xc0c4mh4C93Wk:yzwQGnHZP+ycdhvR

    Score
    10/10
    blustealerdiscoverypersistencestealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks