RisenwareBloodstrike[.]exe

Resubmissions

02/07/2026, 16:52

260702-vdepdsft3l6

02/07/2026, 16:50

260702-vcc46sh17v6

Sharing

Copy URL Twitter E-mail

General

Target
RisenwareBloodstrike.exe
Size 1.7MB
Sample260702-vdepdsft3l
SHA256 b9e4020f5968e8ff1b53add888e0be36adaf07556466ef9c126d23447b09e2a0
MD5 cf8fddafe68d54384776aea17d8a3f41
SHA1 a12456c977d92c78a65e1e08d898dd5329bbfc6e
SHA512 16fefcabda6ab4e37b54fd2c77ec70d98e78b51dc471b5300e336fa44ccede7220adea30f0c9742494a9a4796ecab8a8bfcb2c1bc36855b267ead74f381329eb
SSDEEP 24576:Y8sKnytZ2lMrcKRPObrD2whd/qUxuW/w/ZXCmL10I:Bx6Z73OfDvP/qA7SCmLKI
TLSH
T18985AF12E76102ECC26BC178CA528B0BF771780513249BDF26E05A666F27BF05FBA751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RisenwareBloodstrike.exe

File Explorer

RisenwareBloodstrike.exe

.exe 1.7MB

RisenwareBloodstrike.exe

IMPHASH e5ab527d0cf534a050394c1f2324a344
SHA256 b9e4020f5968e8ff1b53add888e0be36adaf07556466ef9c126d23447b09e2a0
MD5 cf8fddafe68d54384776aea17d8a3f41
SHA1 a12456c977d92c78a65e1e08d898dd5329bbfc6e
SHA512 16fefcabda6ab4e37b54fd2c77ec70d98e78b51dc471b5300e336fa44ccede7220adea30f0c9742494a9a4796ecab8a8bfcb2c1bc36855b267ead74f381329eb
SSDEEP 24576:Y8sKnytZ2lMrcKRPObrD2whd/qUxuW/w/ZXCmL10I:Bx6Z73OfDvP/qA7SCmLKI
TLSH
T18985AF12E76102ECC26BC178CA528B0BF771780513249BDF26E05A666F27BF05FBA751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

819040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

d3dcompiler_47

D3DCompile

winmm

timeBeginPeriod

kernel32

CloseHandle GetProcAddress GetModuleHandleW ReadFile GetModuleFileNameA MoveFileA GetCurrentProcess GetStdHandle WriteFile TerminateProcess CreateMutexA ReadConsoleA GetLastError CreateFileA DeleteFileA FreeConsole Module32FirstW GetLocalTime LocalFree ReadProcessMemory WideCharToMultiByte GetConsoleWindow Module32NextW CreateProcessA CreateDirectoryA FormatMessageA lstrcmpiW AllocConsole lstrcmpW IsDebuggerPresent CheckRemoteDebuggerPresent Process32FirstW QueryPerformanceCounter GetFileSizeEx Sleep HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetACP IsValidCodePage ReadConsoleW OpenProcess GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect QueryPerformanceFrequency Process32NextW CreateFileW WaitForSingleObject DeviceIoControl WriteProcessMemory GetOEMCP GetCommandLineA HeapAlloc CreateToolhelp32Snapshot SetStdHandle HeapSize UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext SetEnvironmentVariableW FreeEnvironmentStringsW GetModuleFileNameW ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader GetCommandLineW RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetEnvironmentStringsW WriteConsoleW GetConsoleMode SetEndOfFile GetSystemTimePreciseAsFileTime GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo WakeAllConditionVariable GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId

user32

PostQuitMessage SetWindowLongW LoadCursorW RegisterClassExW UpdateWindow GetSystemMetrics CreateWindowExW DestroyWindow DefWindowProcW GetWindowLongW SendInput SetForegroundWindow UnregisterClassW TranslateMessage SetLayeredWindowAttributes MessageBoxA PeekMessageW DispatchMessageW GetAsyncKeyState ShowWindow

gdi32

GetStockObject

advapi32

CryptHashData CryptReleaseContext CryptGetHashParam CryptAcquireContextW ConvertSidToStringSidA CryptCreateHash GetTokenInformation CryptDestroyHash OpenProcessToken

shell32

SHGetFolderPathA ShellExecuteW

ws2_32

WSAStartup getaddrinfo ntohl WSACleanup freeaddrinfo

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpQueryDataAvailable

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCreateHash BCryptGenRandom

crypt32

CryptBinaryToStringA CryptStringToBinaryA

Name

.text

Size

1008KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

290KB

Virtual Size

289KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

354KB

Virtual Size

619KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

RisenwareBloodstrike.exe

d3d11

dwmapi

d3dcompiler_47

winmm

kernel32

user32

gdi32

advapi32

shell32

ws2_32

winhttp

bcrypt

crypt32

generic