Overview

overview

10

Static

static

1

bad8d61372...18.exe

windows7-x64

6

bad8d61372...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bad8d6137259ef83582abfea9f4b2f17_JaffaCakes118

  • Size

    733KB

  • Sample

    241203-akrmbawlfr

  • MD5

    bad8d6137259ef83582abfea9f4b2f17

  • SHA1

    06af0f72796e977537be7235960326137e1cb821

  • SHA256

    1fbc3ddcd892c868cab037f43fcee5cd1dd67f5ce0ac882d851603bdc934ec43

  • SHA512

    24c7a7f361ffc5f283c867b6c132d54c39a1c443cb8703415a93159ce3fb153e622a29493f9817a891dd10b50abb16b73ee0de8433d9a65af77c8c8cdb1faa22

  • SSDEEP

    12288:QzpM6vs9z8N5ndgaIgAz0ioW608I5dgytMveLBxuff3p3qyrOQKCFLSjTMJxtU1:m7sK5maIgdioWCI5d9keLBxuff3p3qyG

Score
10/10
blustealerdiscoverypersistencestealer

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:     smtp
  • Host:
    bojtai.club
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    BqYD=SYf~ueg

Targets

    • Target

      bad8d6137259ef83582abfea9f4b2f17_JaffaCakes118

    • Size

      733KB

    • MD5

      bad8d6137259ef83582abfea9f4b2f17

    • SHA1

      06af0f72796e977537be7235960326137e1cb821

    • SHA256

      1fbc3ddcd892c868cab037f43fcee5cd1dd67f5ce0ac882d851603bdc934ec43

    • SHA512

      24c7a7f361ffc5f283c867b6c132d54c39a1c443cb8703415a93159ce3fb153e622a29493f9817a891dd10b50abb16b73ee0de8433d9a65af77c8c8cdb1faa22

    • SSDEEP

      12288:QzpM6vs9z8N5ndgaIgAz0ioW608I5dgytMveLBxuff3p3qyrOQKCFLSjTMJxtU1:m7sK5maIgdioWCI5d9keLBxuff3p3qyG

    Score
    10/10
    discoverypersistenceblustealerstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Blustealer family

      blustealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks