MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77053cffbf81fc755f5d119b907f63456ff18706a3274bf619315baf03411087. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BluStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77053cffbf81fc755f5d119b907f63456ff18706a3274bf619315baf03411087
SHA3-384 hash: d6e23e81ebbac0270bcf00b5464a2cab67986b2485c6da1c6124b9a4571bd0433879b2074918708039e234c56a0c9911
SHA1 hash: fb253b22ae678164dad4de1f8f472a1338c8582a
MD5 hash: 72048fbaab48b29537a9b8b6af6bd37d
humanhash: apart-failed-chicken-arkansas
File name:BPL_1057230.exe.vir
Download: download sample
Signature BluStealer
Create hunting rule
File size:192'000 bytes
First seen:2022-06-20 17:12:32 UTC
Last seen:2022-06-20 17:36:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 768:en/gFBnsd0KSwkHhp8pQVkW7/eeXNoq/oor64o8ZJ:ECjwuv8c97/eeXNoq/oou4o8ZJ
Threatray 1'524 similar samples on MalwareBazaar
TLSH T13514035FED00AC8CCA750AFB6B75C3006D647E46AE1F46DD238CF68B8232545662C6ED
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 00ecd0f0f0d0c400 (9 x AgentTesla, 2 x BluStealer, 1 x SnakeKeylogger)
Reporter KdssSupport
Tags:BluStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
288
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase order 037839
Verdict:
Malicious activity
Analysis date:
2022-06-20 13:56:04 UTC
Tags:
opendir loader
Link:
https://app.any.run/tasks/2d85dc78-c51f-4e64-b41e-73592c2193a5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/281688/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.7953.4843.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.W32.AIDetectNet.01.3063.14667.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Creating a file
Using the Windows Management Instrumentation requests
Searching for the window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62b0aadef4dd1ffb77a4d0b3/reports/213900aa-09da-4c8b-9985-202919ea2241/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/65433b84-cb89-4a32-b9ab-331dd4237f2e
Result
Threat name:
BluStealer, SpyEx
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1016545
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates multiple autostart registry keys
DLL side loading technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes or reads registry keys via WMI
Writes to foreign memory regions
Yara detected BluStealer
Yara detected Costura Assembly Loader
Yara detected SpyEx stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 649040 Sample: BPL_1057230.exe.vir Startdate: 20/06/2022 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus detection for URL or domain 2->52 54 8 other signatures 2->54 7 BPL_1057230.exe.exe 16 7 2->7         started        12 Rvkkghcc.exe 14 2 2->12         started        14 Rvkkghcc.exe 2 2->14         started        16 2 other processes 2->16 process3 dnsIp4 46 www.sanipass-solutions.fr 164.132.235.17, 49772, 49797, 49801 OVHFR France 7->46 40 C:\Users\user\AppData\...\Rvkkghcc.exe, PE32 7->40 dropped 42 C:\Users\...\Rvkkghcc.exe:Zone.Identifier, ASCII 7->42 dropped 44 C:\Users\user\...\BPL_1057230.exe.exe.log, ASCII 7->44 dropped 70 Creates multiple autostart registry keys 7->70 72 Writes to foreign memory regions 7->72 74 Injects a PE file into a foreign processes 7->74 18 InstallUtil.exe 4 12 7->18         started        22 InstallUtil.exe 7->22         started        24 cmd.exe 1 7->24         started        76 Antivirus detection for dropped file 12->76 78 Multi AV Scanner detection for dropped file 12->78 80 Machine Learning detection for dropped file 12->80 26 conhost.exe 16->26         started        28 conhost.exe 16->28         started        file5 signatures6 process7 file8 34 C:\Users\Public\...\sqlite3.dll, PE32 18->34 dropped 36 C:\Users\Public\...\SQLite3_StdCall.dll, PE32 18->36 dropped 38 C:\Users\Public\...\reflowed.exe, PE32 18->38 dropped 56 Creates multiple autostart registry keys 18->56 58 Tries to harvest and steal browser information (history, passwords, etc) 18->58 60 DLL side loading technique detected 18->60 62 Tries to steal Crypto Currency Wallets 18->62 64 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 22->64 66 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 22->66 68 Writes or reads registry keys via WMI 22->68 30 conhost.exe 24->30         started        32 timeout.exe 1 24->32         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77053cffbf81fc755f5d119b907f63456ff18706a3274bf619315baf03411087/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-06-20 17:13:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
17 of 26 (65.38%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4ctz757qh6hkx25cgnza73divx7dbygumtux5qzgfn26a2bccdq._file
Verdict:
malicious
Similar samples:
0365280eb3842ba84e01d192e38be3e5b6357a6c8e178955928e7639f2b8f442
BluStealer
089d64094a0cbe3fc87733eaf8f49bb1d818948429fa80de8953b8ff2c667a6a
BluStealer
16a65becc015149e6569c25dc65a9af23d67ffe7fd88ecf616a90b01c60a16ba
BluStealer
1c57865eee1285666f6fbc185980bbdcab91e96b7f906f7d51c7c95827e6d241
BluStealer
792bc8203c1c9e51685d264f5bb7a78f3a3fcf15ff7bfba813e2b5affa0909c8
BluStealer
89fd50a006af9537d9181a8d2dd4872cd29639150ef2ed96a93ed1c3ad1967a4
BluStealer
8f66ff28a6f980ec9211dec93dc22411b479a257238f8405c7e9e038c9b53223
BluStealer
beae6f9716a4543dfa1a0ed79ddc4ae62215a9637082c61419a15b4a066324b8
BluStealer
c0ad726c33bd7a5bb7bfc56882d658f9bef030217ce0db125d4689edf5d54b98
BluStealer
e4af6a6b4243bb6971be7edc28f16198ff88734d6a764dcddc6f5c6424309bd6
BluStealer
+ 1'514 additional samples on MalwareBazaar
Result
Malware family:
blustealer
Create hunting rule
Score:
  10/10
Tags:
family:blustealer persistence stealer
Link:
https://tria.ge/reports/220620-vrdz1sabb2/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
BluStealer
Unpacked files
SH256 hash:
77053cffbf81fc755f5d119b907f63456ff18706a3274bf619315baf03411087
MD5 hash:
72048fbaab48b29537a9b8b6af6bd37d
SHA1 hash:
fb253b22ae678164dad4de1f8f472a1338c8582a
Link:
https://www.unpac.me/results/138d68c7-92f8-482f-bac3-368a970e8bbb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/77053cffbf81fc755f5d119b907f63456ff18706a3274bf619315baf03411087

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BluStealer

Executable exe 77053cffbf81fc755f5d119b907f63456ff18706a3274bf619315baf03411087

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2246072/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/281688/
  
URLhaus
https://urlhaus.abuse.ch/url/2246156/

Comments