Statik Analiz — BluStealer | HIGH | CVSS: 7.5

File

SHA256379add8e590ff86192b3efc1c135b12e8001cdf6743163c2326137c8a5e88761
MD500a55d220ab15e859ed7cbe42c22190f
File379add8e590ff86192b3efc1c135b12e8001cdf6743163c2326137c8a5e88761.exe
Size26,112 byte
TypePE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections
Stringler129

Bölümler

AdEntropi
.text5.4
.rsrc2.21
.reloc0.08

Import Tablosu

  • mscoree.dll

IOC

SHA256379add8e590ff86192b3efc1c135b12e8001cdf6743163c2326137c8a5e88761
MD500a55d220ab15e859ed7cbe42c22190f
IP1.1.1.9, 1.0.0.0, 4.0.0.0, 16.0.0.0, 16.10.0.0
Domainopenssl.org, system.net, system.io
C2openssl.org, system.net, system.io

BluStealer — Malware Profile

BluStealer VB6/VBS stealer 2021. Telegram Bot /sendDocument C2. TSC developer. Tarayici+email+kripto.

Malware Type
Infostealer
Programming Language
VB6/VBScript
C2 Protocol
Telegram Bot API
Target Systems
Küresel

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC List (8 indicators)

IOC — BluStealer
# IP 1.1.1.9 # IP 1.0.0.0 # IP 4.0.0.0 # IP 16.0.0.0 # IP 16.10.0.0 # DOMAIN openssl.org # DOMAIN system.net # DOMAIN system.io
TypeValueNote
ip 1.1.1.9 C2 aday
ip 1.0.0.0 C2 aday
ip 4.0.0.0 C2 aday
ip 16.0.0.0 C2 aday
ip 16.10.0.0 C2 aday
domain openssl.org C2 domain
domain system.net C2 domain
domain system.io C2 domain
BluStealer — Go to Full Profile →

C2 Servers (8 recorded servers for this family)

Address Type Port Protocol Status Country
digicert.com domain — TCP active —
sectigo.com domain — TCP active —
microsoft.com domain — TCP active —
xanasoft.com domain — TCP active —
sandboxie-plus.com domain — TCP active —
github.com domain — TCP active —
digicert.com domain — TCP active —
digicert.com domain — TCP active —

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
BluStealermalwarestatik-analizIOC