Overview

overview

10

Static

static

1

New Order.exe

windows7-x64

10

New Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Order.exe

  • Size

    499KB

  • Sample

    230222-epmldahg79

  • MD5

    ffa979499187908e3abd52a5eb23ba98

  • SHA1

    313c4451e3e5473732c9b2cef7c943060a91f452

  • SHA256

    1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b

  • SHA512

    1861e3b2593934611181c71c31d2237bb8df839d555f003e8b4110a9d1ab4612180fd59af97349be0cf416a2e7fc455f7f39e62f4785deb2c94bc503985ed31f

  • SSDEEP

    12288:/Ysz65It6fQFY4LvtsnEdCBl5cll3rVLDHqFS:/YszDt6fQnGnGWilt5DHqFS

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      New Order.exe

    • Size

      499KB

    • MD5

      ffa979499187908e3abd52a5eb23ba98

    • SHA1

      313c4451e3e5473732c9b2cef7c943060a91f452

    • SHA256

      1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b

    • SHA512

      1861e3b2593934611181c71c31d2237bb8df839d555f003e8b4110a9d1ab4612180fd59af97349be0cf416a2e7fc455f7f39e62f4785deb2c94bc503985ed31f

    • SSDEEP

      12288:/Ysz65It6fQFY4LvtsnEdCBl5cll3rVLDHqFS:/YszDt6fQnGnGWilt5DHqFS

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks