Rewterz Threat Alert – BluStealer Infostealer aka a310logger – Active IOCs

Severity

Medium

Analysis Summary

BluStealer is a type of malware known as an Infostealer, which is designed to steal sensitive information from infected computers. BluStealer specifically targets user credentials, such as usernames and passwords, from web browsers and email clients. Once installed on a victim’s computer, BluStealer can silently gather information and send it back to the attackers who control the malware. This stolen information can be used for a variety of nefarious purposes, such as identity theft, financial fraud, and espionage.

This malware targets personal computers and goes after sensitive information such as browser credentials, FTP applications, credit card details, and personal crypto wallets highlighting the serious threat it poses to individual users.

BluStealer is typically spread through phishing emails, malicious downloads, or other forms of social engineering that trick users into downloading and installing the malware. To protect against BluStealer and other types of Info stealers, it is important to practice good cybersecurity hygiene, such as using strong passwords, keeping software up to date, and avoiding suspicious emails or downloads.

Impact

• Keystroke Logger
• Information Stealer

Indicators of Compromise

MD5

• 170860057f4aad06ddbeea0ca2b3f1b6
• e0236718f5d4d70c2dc485d322834897
• 26d46c2c07d584f1a04280f47182e909
• 30109593131c48efe8a355f8b387dd4a
• a9419910dc159e785f4f7d060b99703d

SHA-256

• e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
• 5923a0d6ac3cd029ce06706021aaaff83c55193a23c2d5fedd5b3cdd0065b081
• 295ebe6ba820bb813c6e9dd5526bf194a8da0268085ba0fc805f19c1ae3c6186
• 1e712ef0a37d9e8d2f6ef512da2438ef05e073cde9ae6677858b9ebbd1c23b2b
• 56fe514e3ea3eda0569cf8b79741fe9ed9b391fe06f07b33d847ccdd7fda18ae

SHA-1

• db04c735b769df458518f959ae7eca39cfa06213
• f0276ffdd801d3440918269f5d880f0502bda55e
• 381ec91ba5c4206be19a10a1cb0d2328a9385d71
• f6d8e1eb36925ceb97024cfe2d71f3573d72a202
• 164c8c53881f9e65d19233c6b9eed1d0231e7cfb

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Check for any unauthorized transactions or activities on your financial accounts and report any suspicious activities to the respective authorities.
• Ensure that your operating system and all applications are up to date with the latest security patches and updates to prevent vulnerabilities that can be exploited by malware.
• Implement two-factor authentication for your online accounts to provide an additional layer of security.
• Avoid downloading and installing pirated software, as these sites are often a source of malware infections.
• Educate yourself and your employees on safe computing practices, such as being cautious when opening emails and downloading attachments, to prevent future infections.