Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    bluestealer.rar

  • Size

    5.6MB

  • MD5

    a90f4f14fd13ca22cfeb32127493bb3c

  • SHA1

    680a9f3b7d74575cdd91f461e9e2b47c10e5c79c

  • SHA256

    ee66a185008549b9ca0c687a78aa6a69e4770dd12cab9dc63d5346c1f570904b

  • SHA512

    69fee2468fdb90e4dfebe18dd90f040be372a8d7c35f049d1f594c4f6ec37a7bb9fb8f2c847114e315b214e823d3921d4260b3770628903a875a8b9fbb270a66

  • SSDEEP

    98304:xIb3rOEojkouUyLJ/IIDwOMTwKoD+ORWkt78cZfHKDDFaWI5Sz3ptM9b3Pd4g6wx:izaEJvD0WD+OP8QfqmSz3pt2zV4g6SmC

  Score

  10^/10

  agentteslaasyncratazorultformbookredlinerevengeratsectopratsnakekeyloggerxloader@baobabss@chucoed@l_like_a_sir_l@tupa187defaultnyancatrevengemjyvo4msqs23defense_evasiondiscoveryexecutioninfostealerkeyloggerloaderpersistenceprivilege_escalationratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • AgentTesla payload

  • Async RAT payload

    rat

  • Formbook payload

    rat

  • Xloader payload

    rat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1