MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08e9b87ddb401b7d06928ddc9034e7057b57667ed2b3c2f4b8ec9209aeaca055. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BluStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08e9b87ddb401b7d06928ddc9034e7057b57667ed2b3c2f4b8ec9209aeaca055
SHA3-384 hash: 7b0a81d3c0d618b4663371cfd055f274085640d55db1ffda6093a5f54fe244bde9cd1e81cca8b37bc16783fdb2c402ed
SHA1 hash: 7a3ec799412a4fdd3af8a370aa064f66edb4b653
MD5 hash: eb56c4825ec85ad8a31769d718cfff54
humanhash: tango-march-india-east
File name:INWARD RMT.exe
Download: download sample
Signature BluStealer
Create hunting rule
File size:967'680 bytes
First seen:2023-04-19 13:13:11 UTC
Last seen:2023-04-22 04:18:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:ZWqTC/fbyAvWIKZKGcd9FGo28HusyPVPbVKY0Zv:ZjOvW9FyWl8ORPLKYQv
Threatray 101 similar samples on MalwareBazaar
TLSH T1402502ADA3F5D7A7C2A50BBD001A628D3B7551E73173D93CEF87408AEA93B041D8458B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 2050707096cc4860 (6 x AgentTesla, 5 x SnakeKeylogger, 3 x Loki)
Reporter James_inthe_box
Tags:BluStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
251
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INWARD RMT.gz
Verdict:
Malicious activity
Analysis date:
2023-04-19 08:50:16 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/0c360428-727e-4331-847d-1a4d8f2d5834

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/383290/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/643fe91b12f914d0711b5be7/reports/04a98cdc-a00c-4467-96f8-57087e5cf90d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/08e9b87ddb401b7d06928ddc9034e7057b57667ed2b3c2f4b8ec9209aeaca055
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4c7db0e1-869e-4b22-842e-5db27119888d
Result
Threat name:
BluStealer, ThunderFox Stealer, a310Logg
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1217557
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected a310Logger
Yara detected BluStealer
Yara detected ThunderFox Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08e9b87ddb401b7d06928ddc9034e7057b57667ed2b3c2f4b8ec9209aeaca055/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdu3q7o3ianx2busrxojanhhav5vozt62kz4f5fy5sjatlvmubkq._file
Verdict:
malicious
Similar samples:
0f71aedb95163de525fa395b1a444f48222bc28b70521bff45467cbf98b63b9a
BluStealer
1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b
BluStealer
58d5286e5694f883d2452a81e5f6e77413292ba388300a6e44dd0f91e217aff1
BluStealer
642788b753c8802d30666e5d6d2a2e4c9d810583e3af7fcb2983dd219c4526e7
BluStealer
6d4991fcf138200aacef788de1bdef481b0bef6200652e64348285614c2d7f20
BluStealer
708f366019c67cdec28a6950aa2a24f4ba274ebdadc35339ce1208ea971fc668
BluStealer
9842d23cef4dc305ab6b8cd1ade477e1186d94cfd18861e1c87a55aff4d04c40
BluStealer
b0b430c82cc574323d38d65365540472f3f0e6133dcb36e20ee9fcf5483769fa
BluStealer
c26bf76c00885577a5aeacd05387893d936bf122aaf3999dcb0dee3be14fcfcd
BluStealer
f91550582e9e831cba0a8ee62a9a47b3f9a4f1f24e228353d6f5050bc1b52509
BluStealer
+ 91 additional samples on MalwareBazaar
Result
Malware family:
blustealer
Create hunting rule
Score:
  10/10
Tags:
family:blustealer collection stealer
Link:
https://tria.ge/reports/230419-qgmrysaf82/
Behaviour
Script User-Agent
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
BluStealer
Malware Config
C2 Extraction:
https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474
Unpacked files
SH256 hash:
fc9bb9746aaa4e07944b2c1338d26ac852531a6e6c97e98f6a56202d27ff607c
MD5 hash:
d2ec533f8b40a8224d79c87c2291f943
SHA1 hash:
f305fa4c5c8525e853fbdbcf5c8cedad9ba08fd2
Link:
https://www.unpac.me/results/162768f5-5873-423f-86f9-3f7f9bb57b89/
SH256 hash:
381fcdd12f00fa6028d0aa1cda67d58e3091b9e4873ac133bd482055603c9959
MD5 hash:
ad89ca02f386524145ac799d51ac0173
SHA1 hash:
388f638b654f1a8a3d2ec1919cfadd35b4c3c535
Link:
https://www.unpac.me/results/162768f5-5873-423f-86f9-3f7f9bb57b89/
SH256 hash:
d0dd81050b6a57cd0f441377c1cfde5d7ae37e4d2338decbe728576e4dbdda9e
MD5 hash:
b49ffa2c5569236498c2a4345eabe8f9
SHA1 hash:
226879c4e986486fa8e52f4c2a89d5123dd50309
Link:
https://www.unpac.me/results/162768f5-5873-423f-86f9-3f7f9bb57b89/
SH256 hash:
870e679e7f1bf217ba8987b4d310adfe785548db7ab44bc168a8c3ccfab33cba
MD5 hash:
dbfa58f6b837b9e22b86e17f675d3600
SHA1 hash:
fbf8a9a41915d981b56371afdc1752064cd1a2a3
Link:
https://www.unpac.me/results/162768f5-5873-423f-86f9-3f7f9bb57b89/
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
Link:
https://www.unpac.me/results/162768f5-5873-423f-86f9-3f7f9bb57b89/
SH256 hash:
998feab5bc127dd13b30a7e7b793d6dc966158d8f8dbecea4bdfde4748c72fb1
MD5 hash:
09a92835a6d6b8f2f7b3b8a590b89d98
SHA1 hash:
6c1233c42f8c662107fce8fa832bec23e064bc6c
Link:
https://www.unpac.me/results/162768f5-5873-423f-86f9-3f7f9bb57b89/
SH256 hash:
5e5c8fe4e53980a98b48fe6b19155edf0f0d285ed899c61dbf4f880583ddf1d2
MD5 hash:
b3bbc5461d12f07ea893bf415dfe7c89
SHA1 hash:
40c3156c471d2afe3fd88c7d20cf93e5782e1bd6
Link:
https://www.unpac.me/results/162768f5-5873-423f-86f9-3f7f9bb57b89/
SH256 hash:
08e9b87ddb401b7d06928ddc9034e7057b57667ed2b3c2f4b8ec9209aeaca055
MD5 hash:
eb56c4825ec85ad8a31769d718cfff54
SHA1 hash:
7a3ec799412a4fdd3af8a370aa064f66edb4b653
Link:
https://www.unpac.me/results/162768f5-5873-423f-86f9-3f7f9bb57b89/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/08e9b87ddb40/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/08e9b87ddb401b7d06928ddc9034e7057b57667ed2b3c2f4b8ec9209aeaca055

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/383290/

Comments