MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 642788b753c8802d30666e5d6d2a2e4c9d810583e3af7fcb2983dd219c4526e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
BluStealer
Vendor detections: 12
| SHA256 hash: | 642788b753c8802d30666e5d6d2a2e4c9d810583e3af7fcb2983dd219c4526e7 |
|---|---|
| SHA3-384 hash: | 51b544c695b6d7ec0ddbae0193d9d5019bfedb33091a7a2658fa13ab0b6fcfbb43a029630d1d05832dcd7d318d0db6d7 |
| SHA1 hash: | a91442c5fc2a806f2a73110d761f3c2d0923d694 |
| MD5 hash: | ad39b3a11ed93999ec47bb2004822923 |
| humanhash: | florida-equal-illinois-foxtrot |
| File name: | Draft BL.exe |
| Download: | download sample |
| Signature | BluStealer |
| File size: | 842'752 bytes |
| First seen: | 2023-04-14 19:26:27 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:GPPBLdk29XW6to9ejUKAQLSiXX/i/SUm:G/LXWexYLqfmSUm |
| Threatray | 97 similar samples on MalwareBazaar |
| TLSH | T1570523157A2C5B51C7FE63FD184A06640B3729056732EB6E2C4CE0EB5BF97140AA6F83 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter | Anonymous |
| Tags: | BluStealer exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
286
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Draft BL.exe
Verdict:
Malicious activity
Analysis date:
2023-04-14 19:29:40 UTC
Tags:
stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
comodo packed
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Verdict:
Malicious
Result
Threat name:
BluStealer, ThunderFox Stealer, a310Logg
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected a310Logger
Yara detected BluStealer
Yara detected ThunderFox Stealer
Behaviour
Behavior Graph:
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 87 additional samples on MalwareBazaar
Result
Malware family:
blustealer
Score:
10/10
Tags:
family:blustealer collection stealer
Behaviour
Script User-Agent
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
BluStealer
Malware Config
C2 Extraction:
https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474
Unpacked files
SH256 hash:
fc9bb9746aaa4e07944b2c1338d26ac852531a6e6c97e98f6a56202d27ff607c
MD5 hash:
d2ec533f8b40a8224d79c87c2291f943
SHA1 hash:
f305fa4c5c8525e853fbdbcf5c8cedad9ba08fd2
SH256 hash:
6f1bf3d15ba85460ae87655beae41f80177e5f36c0240e2b699b2ee9e9215f31
MD5 hash:
fb0443c9c8832dd77af0ed8bcdd2a428
SHA1 hash:
8928d7adc8607f45024c17c0369daef2a4ef1607
SH256 hash:
215af82482fad798ef0612ee2c7e80c3f02fd2416405691d5bc98d57b10b08cb
MD5 hash:
40a937058255865968cde122aca037bb
SHA1 hash:
483af05d4b166225df7057e9b60c3cacc3ee34ac
SH256 hash:
2cfd8a1db39c4a715a4c7f943d16f89ac6bf45af88aef04282fe3958519911d3
MD5 hash:
c6a8bde9bec209b8b34525f83dc6720c
SHA1 hash:
9e9b3eb79843aafb6538f1f4bd1099516465a12e
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
SH256 hash:
8c4f1356fb82f546569c15bd408f2ae2c3c2a887e9bc28151db6e5c7bce3af4f
MD5 hash:
d8f253688e8f31e9acc06d8f696d1ff9
SHA1 hash:
8a82d31d0550051bb9a40e43e5a0f94d0c8ef6df
SH256 hash:
2bd0f18d8e089ee964e99e97103de19e2ee591912f81f87b9dd04e786024087f
MD5 hash:
096c4196ba3b81936b126e938cce5c2c
SHA1 hash:
534de2446f2a2137a059326ada13cd620c2ffe8d
SH256 hash:
642788b753c8802d30666e5d6d2a2e4c9d810583e3af7fcb2983dd219c4526e7
MD5 hash:
ad39b3a11ed93999ec47bb2004822923
SHA1 hash:
a91442c5fc2a806f2a73110d761f3c2d0923d694
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Dotnet_Hidden_Executables_Detect |
|---|---|
| Author: | Mehmet Ali Kerimoglu (@CYB3RMX) |
| Description: | This rule detects hidden PE file presence. |
| Reference: | https://github.com/CYB3RMX/Qu1cksc0pe |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.