Overview

overview

10

Static

static

1

new order 152421.exe

windows7-x64

10

new order 152421.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    new order 152421.7z

  • Size

    485KB

  • Sample

    230222-lbd6eaaf33

  • MD5

    c178c543736ea88866607e17cce7a8e7

  • SHA1

    c604edd9dac99503d9031c1665fcc114f1965f7a

  • SHA256

    0783b26e505f18dcdba2894411cfd4eae3a39123e62f7a4e55d34a7d90a90a81

  • SHA512

    218e4f38d4bef7e96a6920926475cf888a5fd030d82469a38fd2f20e5cab03a14411d6e4648e690874191afaf217afa8bdc7edd3fefc49a277aea5b2ad03cec4

  • SSDEEP

    12288:iozMSuyd1Bmm+v2e9mUS1NqBBchWP6P0vMLxJ2g0ExsvPn7jhPvl9iqn++:iozJu6o2e9nUNqw66P0vgLx+P7F19iqZ

Score
10/10
blustealercollectionstealer

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5450700540:AAEJyEEV8BKgYUKmnCPZxp19kD9GVSRup5M/sendMessage?chat_id=5422342474

Targets

    • Target

      new order 152421.exe

    • Size

      501KB

    • MD5

      460bdbbe5a6b8bd3f887c8b6fd4128a2

    • SHA1

      891099bcbf82de10e1b197d2c42b2044dc0bed46

    • SHA256

      58d5286e5694f883d2452a81e5f6e77413292ba388300a6e44dd0f91e217aff1

    • SHA512

      b741e4bc33762adc9dee71f7a348ec9e7615bd4631bb73c39e4d69a01e8d469a3eb1aa303c691e2671aa939c223c6fc4a5bc05b2dea23b40f3e5422e2b4b3c6c

    • SSDEEP

      12288:/YFfpyLOuydXBmm+vie9mUX1NqRBchWc6P0vMLxJRg0ExsOPn7jhPhl9iqo+/:/YFhyCuCoie9nFNqgL6P0vlLxVP7FT93

    Score
    10/10
    blustealercollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks