MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbf75a247c2141d83e39f08a304bfde553e4e1553bb0524721bd4c8b189ebb02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BluStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbf75a247c2141d83e39f08a304bfde553e4e1553bb0524721bd4c8b189ebb02
SHA3-384 hash: 3016552387638dedf2c45b2f2de06d154e1e44362d22269d5d3b1019feb1b63f619ab006120cf37de14d83ba74388e5f
SHA1 hash: b5ec4fd353c3c19a9e46dcc22440b7ca8bd8994e
MD5 hash: 976a912fe44d3b31ef181277129b3ca3
humanhash: music-california-nitrogen-indigo
File name:Quote 1345 rev.7.exe
Download: download sample
Signature BluStealer
Create hunting rule
File size:893'952 bytes
First seen:2023-05-09 08:10:03 UTC
Last seen:2023-05-13 22:56:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:yNj5Aybdjn4Ld+qGrm7UweTXyBFNSzXWwzkUMxNf3o6N9gp59CG5d2f3x2:y37UhxGq7Re4rSyamf4cITCG9
Threatray 112 similar samples on MalwareBazaar
TLSH T134150174A2AE4EE1E10FCAB0197CBDA60E7671D3EAE6457817394500CFB7B142E8854E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter lowmal3
Tags:BluStealer exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
274
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quote 1345 rev.7.exe
Verdict:
Malicious activity
Analysis date:
2023-05-09 08:11:51 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/98d1d807-2b0f-46e9-b990-1f88dc6cd72e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/387748/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.18278.9178.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Sending a custom TCP request
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo jigsaw packed
Link:
https://www.filescan.io/uploads/645a0017b664422b69d5f43a/reports/b5d03673-dd40-48ed-9bcd-d61b2d0b1ada/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/dbf75a247c2141d83e39f08a304bfde553e4e1553bb0524721bd4c8b189ebb02
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e4897df0-fb3f-47a0-9648-f4d714cc7baa
Result
Threat name:
BluStealer, ThunderFox Stealer, a310Logg
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1228995
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected a310Logger
Yara detected BluStealer
Yara detected ThunderFox Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dbf75a247c2141d83e39f08a304bfde553e4e1553bb0524721bd4c8b189ebb02/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2023-05-09 07:48:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3p3vujd4efa5qprz6cfdas754vj6jykvhoyferzbxvgiwge6xmba._file
Verdict:
malicious
Similar samples:
1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b
BluStealer
7042b9a81eaf1ddd3de522f40e80a915e0e44c6843320013daaa8ee2a842a9e2
BluStealer
708f366019c67cdec28a6950aa2a24f4ba274ebdadc35339ce1208ea971fc668
BluStealer
a83688213da481b066908e16d7a2206180627bcef8c69e4fe756dc06c5c35ec0
BluStealer
c269b1931db163462343d0ecd8ef501e35e4da91c91f1464c8d526ef07a041bd
BluStealer
c37e211564b4d5b3447fd8be8526724a4193ac8d9a99efddc3d599f7b5e6af51
BluStealer
d50e53128afae84f81f41fce22e7ce3f13442485d7c7ce3bb1417afaba6c9c05
BluStealer
ed9b8b2727090a9a786fd014f3716eda74f0943e02c215c04c07613c3f271de9
BluStealer
+ 102 additional samples on MalwareBazaar
Result
Malware family:
blustealer
Create hunting rule
Score:
  10/10
Tags:
family:blustealer collection stealer
Link:
https://tria.ge/reports/230509-j2qwsaeh56/
Behaviour
Script User-Agent
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
BluStealer
Malware Config
C2 Extraction:
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Unpacked files
SH256 hash:
fc9bb9746aaa4e07944b2c1338d26ac852531a6e6c97e98f6a56202d27ff607c
MD5 hash:
d2ec533f8b40a8224d79c87c2291f943
SHA1 hash:
f305fa4c5c8525e853fbdbcf5c8cedad9ba08fd2
Link:
https://www.unpac.me/results/c382d80d-cc61-4a18-8209-8846aa48ddc8/
SH256 hash:
36e7bc1d2ae8d8419b0983034f5eb809a4ea0d24676ea1f8b0a7569926a0b84c
MD5 hash:
52756994e44514f825f435819cb9f4d5
SHA1 hash:
8f80c11dcfbb00c33242d2e3aa004f9e325b78e3
Link:
https://www.unpac.me/results/c382d80d-cc61-4a18-8209-8846aa48ddc8/
SH256 hash:
a4b55247b3e10d05aad24505daa475ce6ec27682337857a6cf0031aacf2a155c
MD5 hash:
494a605ec14a0bd14ad3db0eed037454
SHA1 hash:
fe244e37cb29ba0c6b6a1744d91ec05a6194f726
Link:
https://www.unpac.me/results/c382d80d-cc61-4a18-8209-8846aa48ddc8/
SH256 hash:
2a048f9a1eafd32d4c397d48b01c2aa93d46bb269bf9909cfa1e13878976a223
MD5 hash:
daba130cfcd302d02b08f62f6aa7d5e5
SHA1 hash:
e451d4928c1100a1b2a4d5999435cb576b94e16b
Link:
https://www.unpac.me/results/c382d80d-cc61-4a18-8209-8846aa48ddc8/
SH256 hash:
77dc6d765896c8b480bdf3c5c703196419dff6722b1dea2da7f2f7893a1e55b4
MD5 hash:
ec258a99e8d20e6389fd1496cca48b51
SHA1 hash:
c9e096cbc29ad0ba55b1216228f06b23ccb715d9
Link:
https://www.unpac.me/results/c382d80d-cc61-4a18-8209-8846aa48ddc8/
SH256 hash:
d8fc5dfdf2800247eb610beb076fec4d2becf6d951e89445d43237fe97814218
MD5 hash:
e5d93dadd08b8bc727e4f4853c6881ba
SHA1 hash:
27e0e057d33f01586193b0cbf06561c2863951f4
Link:
https://www.unpac.me/results/c382d80d-cc61-4a18-8209-8846aa48ddc8/
SH256 hash:
d5e5d1ad1fb3c9c2ab926b8ea2762dfb2ac8a47f7d7b4083170e6c673baff0cb
MD5 hash:
dfa30ea15ff3c7db7cbb5a596e51b1c6
SHA1 hash:
068c53748a50365655303ff4a6f237979cb4bc98
Link:
https://www.unpac.me/results/c382d80d-cc61-4a18-8209-8846aa48ddc8/
SH256 hash:
dbf75a247c2141d83e39f08a304bfde553e4e1553bb0524721bd4c8b189ebb02
MD5 hash:
976a912fe44d3b31ef181277129b3ca3
SHA1 hash:
b5ec4fd353c3c19a9e46dcc22440b7ca8bd8994e
Link:
https://www.unpac.me/results/c382d80d-cc61-4a18-8209-8846aa48ddc8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dbf75a247c21/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BluStealer

Executable exe dbf75a247c2141d83e39f08a304bfde553e4e1553bb0524721bd4c8b189ebb02

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/387748/

Comments