blakcsee_stealer | 02a95012756ab2a822052e432c310114404132ef959f0fa88f5fea6e8e46becd

General

Target
everything-software-windows-5.37.8.zip
Size 133.0MB
Sample260723-hbtpbasfpg
SHA256 02a95012756ab2a822052e432c310114404132ef959f0fa88f5fea6e8e46becd
MD5 b86e7f9e202b76526a2c674513533cbf
SHA1 e2e1960e3a3ca6dbc6d6ac8cfe7d5c21dd485479
SHA512 bbacf8f72b285cc2f4c3e1a480a2eefe2e36559c498749306bde3094454fd0eaae813598cf3cc15d61f32fad57aca7c2e4b027f57e806cfec0059d190f7488eb
SSDEEP 1572864:ztHKWflZJl8WuRo5fr2a4sRzLC4VvLzHEKsi+9SYBrXs/KZSjhN/Waic3YygFRnT:FtDJltyjizLTbsi+cYBLcjhRWsLQ2Kf
TLSH
T1FE683305B66940A5D07AE238CE97973AE6B1B4148B2256CB75ECC71E3F237D0973B309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

blakcsee_stealer

C2

37.77.150.162

Targets

- Target
  everything-software-windows-5.37.8.exe
- Size 22KB
- SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
- MD5 41ad4cb04af8def70763d895973584e2
- SHA1 24fd6c86360d98e565bc7f3a6aa8165bc34c325f
- SHA512 db3e871cc646eeab7eb2bbeceb323f0951199ea698f91eaa5eec367e48b461748c472867383560c22bce5cba1d4f09fb25983a92f219c867e8fd40d0c53bb43e
- SSDEEP 384:gMoZapK5vwxSYjWAlaWFOSxE1+aHRN7t0jHvDyR9zv:gnZaBgyEN+2t0rD+9z
- TLSH
  T1FFA27C9ADA78058BF8EA18B08279E98BBC3DB7D31B5092CB0354E6181D137C5FA3475D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4