Extracted

• • Target
    2026-07-08_cfb9a69841332b1647bced439ef9d36b_elex_qilin
  • Size 98KB
  • SHA256 b3eee290a26618e8a457624518c6921f7b107319d35922c2aaacd999f6ea78f7
  • MD5 cfb9a69841332b1647bced439ef9d36b
  • SHA1 0eef2b9fe73717575d119ae97956e775e4fe3df0
  • SHA512 151d625935f38a07ea9f423dd08b90403ce8a0b889d9462745a8165286ee2336043e6607d2ed5d06ad4f1bb2f4413795727fa663fee95dae57e039daa3b79255
  • SSDEEP 3072:E1oEFlt6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+h+hhjhkhMh8h4qHKh+hHhD1:EK
  • TLSH
    T11CA3C34B4E66CDDBD804103B9BEAA26C82E3FC452CDCF35557EEC80664C2918C99E997
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryblihanstealerpersistencestealertrojanadwareransomwarespyware

  • Family: BlihanStealer

    Blihan is a stealer written in C++.

    trojanstealerblihanstealer
  • Custom signature

    Detects executables built or packed with MPress PE compressor

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2