Statik Analiz — BluStealer | YÜKSEK | CVSS: 7.5

Dosya

SHA256d4857086c41f87d49032b1e2e8cfa5407229415d8ef5031c90da84a76636c860
MD59249b7a9aeeb31fde7e3784dd51ba8a8
Dosyad4857086c41f87d49032b1e2e8cfa5407229415d8ef5031c90da84a76636c860.exe
Boyut988,160 byte
TürPE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections
Stringler2,553

Bölümler

AdEntropi
.text7.58
.rsrc3.46
.reloc0.1

Import Tablosu

  • mscoree.dll

IOC

SHA256d4857086c41f87d49032b1e2e8cfa5407229415d8ef5031c90da84a76636c860
MD59249b7a9aeeb31fde7e3784dd51ba8a8
IP16.10.0.0, 4.0.0.0, 16.0.0.0, 1.0.0.0
Domainopenxmlformats.org, microsoft.com, system.io
C2openxmlformats.org, microsoft.com, system.io

BluStealer — Malware Profile

BluStealer VB6/VBS stealer 2021. Telegram Bot /sendDocument C2. TSC developer. Tarayici+email+kripto.

Malware Type
Infostealer
Programming Language
VB6/VBScript
C2 Protocol
Telegram Bot API
Target Systems
Küresel

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC List (7 indicators)

IOC — BluStealer
# IP 16.10.0.0 # IP 4.0.0.0 # IP 16.0.0.0 # IP 1.0.0.0 # DOMAIN openxmlformats.org # DOMAIN microsoft.com # DOMAIN system.io
TypeValueNote
ip 16.10.0.0 C2 aday
ip 4.0.0.0 C2 aday
ip 16.0.0.0 C2 aday
ip 1.0.0.0 C2 aday
domain openxmlformats.org C2 domain
domain microsoft.com C2 domain
domain system.io C2 domain
BluStealer — Go to Full Profile →

C2 Servers (8 recorded servers for this family)

Address Type Port Protocol Status Country
system.io domain — TCP active —
system.io domain — TCP active —
system.io domain — TCP active —
system.io domain — TCP active —
system.io domain — TCP active —
digicert.com domain — TCP active —
system.io domain — TCP active —
sectigo.com domain — TCP active —

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
BluStealermalwarestatik-analizIOC