blustealer | e29247ccbd64ef5da34a09b073f1f638c23bd7d280724feabf900e6ac786af52 | Triage

Sharing

General

Target

6f0df16188d51b39c387df210a1077df_JaffaCakes118
Size

671KB
Sample

241023-p9b1gs1eqa
MD5

6f0df16188d51b39c387df210a1077df
SHA1

abe98a6755bab5b01c2becd90a586829afcb9336
SHA256

e29247ccbd64ef5da34a09b073f1f638c23bd7d280724feabf900e6ac786af52
SHA512

9a2441c332a605893f8b192e42ef61a68d395cc86358d7f4d96dbd592668cbcdf3701bb3a581f011632e66c33a58c7235ec433011bb1c092603457efed84973e
SSDEEP

12288:ZDmzAbVSux7iVK+G2L4SkX8CzdBTAKl2cEGff3kvZp1FXbd4Ga/pzP:0QVSuAVK+G2pkDdBT7l3EW4Trtah

Score

10^/10

blustealer discovery stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot1838876767:AAEiDKTcT_A4WBwpMo9nnrtBP7OvsmEUnNU/sendMessage?chat_id=1300181783

Targets

- Target
  
  6f0df16188d51b39c387df210a1077df_JaffaCakes118
- Size
  
  671KB
- MD5
  
  6f0df16188d51b39c387df210a1077df
- SHA1
  
  abe98a6755bab5b01c2becd90a586829afcb9336
- SHA256
  
  e29247ccbd64ef5da34a09b073f1f638c23bd7d280724feabf900e6ac786af52
- SHA512
  
  9a2441c332a605893f8b192e42ef61a68d395cc86358d7f4d96dbd592668cbcdf3701bb3a581f011632e66c33a58c7235ec433011bb1c092603457efed84973e
- SSDEEP
  
  12288:ZDmzAbVSux7iVK+G2L4SkX8CzdBTAKl2cEGff3kvZp1FXbd4Ga/pzP:0QVSuAVK+G2pkDdBT7l3EW4Trtah
Score

10^/10

blustealer discovery stealer
- BluStealer
  A Modular information stealer written in Visual Basic.
  stealer blustealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blustealerdiscoverystealer

behavioral2