Overview

overview

10

Static

static

1

New Order.exe

windows7-x64

10

New Order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Order.gz

  • Size

    484KB

  • Sample

    230222-hgxm6aab63

  • MD5

    eb36de616abdddebb9d492f94ab05e5e

  • SHA1

    50faf13c4f0c7fefb8bd6bd52d1adbdb01fe1d4f

  • SHA256

    8275d18cde9c9cbf71a4aa7a8dd068d85a7699fcc9f4d49bc285466b1e4f9d49

  • SHA512

    a4b861cef411656c5e23e9bc0d771d75b17943d5f57bc337dea6e483a96458b008680fb1b4ad8cba1d33ca5a6f324f59dbfdaf89cba51a91f8e6b5619b722c08

  • SSDEEP

    12288:eaH2ATmRUTMIQAFicEKaKskncFLi8u7WJHrJIY2:eaZa+T3PNKLbriY2

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Targets

    • Target

      New Order.exe

    • Size

      499KB

    • MD5

      ffa979499187908e3abd52a5eb23ba98

    • SHA1

      313c4451e3e5473732c9b2cef7c943060a91f452

    • SHA256

      1cd904a688c0d0f13f06c5c113ad638649ab10c1ed756dc65933f34bbf22014b

    • SHA512

      1861e3b2593934611181c71c31d2237bb8df839d555f003e8b4110a9d1ab4612180fd59af97349be0cf416a2e7fc455f7f39e62f4785deb2c94bc503985ed31f

    • SSDEEP

      12288:/Ysz65It6fQFY4LvtsnEdCBl5cll3rVLDHqFS:/YszDt6fQnGnGWilt5DHqFS

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks