blustealer | f3911bfcb357c543429f177fb376b93f673aec448e6deebef9e4991fc9baa21f | Triage

Sharing

General

Target

87fe613f5fca069882af2bdb9b53dec7_JaffaCakes118
Size

514KB
Sample

241102-1vd23swmew
MD5

87fe613f5fca069882af2bdb9b53dec7
SHA1

55c8121d2c2277f0899f55bd21b5afb531691f01
SHA256

f3911bfcb357c543429f177fb376b93f673aec448e6deebef9e4991fc9baa21f
SHA512

554017cf9629f4922bb3eff9d2775549fdf7df35a909e41403551a99d927f44a2bf2d67773c0a684c79e58006f9403740e1474ff650e71dfa2890e08169935d6
SSDEEP

12288:cd2+5g27VGBVpVKrLVhrTLdamoA51sSzX4+pVgUwWRDO9G:cf5NEBVpsrLVhPLcmoA3s+x1uG

Score

10^/10

blustealer discovery stealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot1838876767:AAEiDKTcT_A4WBwpMo9nnrtBP7OvsmEUnNU/sendMessage?chat_id=1300181783

Targets

- Target
  
  87fe613f5fca069882af2bdb9b53dec7_JaffaCakes118
- Size
  
  514KB
- MD5
  
  87fe613f5fca069882af2bdb9b53dec7
- SHA1
  
  55c8121d2c2277f0899f55bd21b5afb531691f01
- SHA256
  
  f3911bfcb357c543429f177fb376b93f673aec448e6deebef9e4991fc9baa21f
- SHA512
  
  554017cf9629f4922bb3eff9d2775549fdf7df35a909e41403551a99d927f44a2bf2d67773c0a684c79e58006f9403740e1474ff650e71dfa2890e08169935d6
- SSDEEP
  
  12288:cd2+5g27VGBVpVKrLVhrTLdamoA51sSzX4+pVgUwWRDO9G:cf5NEBVpsrLVhPLcmoA3s+x1uG
Score

10^/10

blustealer discovery stealer
- BluStealer
  A Modular information stealer written in Visual Basic.
  stealer blustealer
- Blustealer family
  blustealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blustealerdiscoverystealer

behavioral2

blustealerdiscoverystealer