blihanstealer | 236d2b63f73cd4e3e1a21418b51ec277532f4acc89ef0c8be935f72bef970f26

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_f420ea0c3677ad56b494194686c43391_elex_qilin_rhadamanthys.exe
Size 118KB
Sample260801-cwl73scb98
SHA256 236d2b63f73cd4e3e1a21418b51ec277532f4acc89ef0c8be935f72bef970f26
MD5 f420ea0c3677ad56b494194686c43391
SHA1 02db2d54fd138d054161b924e853ed4ed60e5764
SHA512 b84db90d06b2755413cf562b8c45b1eef4b25d255710025e999d2fe5d9fe0daaa7c5fca9371e23b9ed9b466f29f79fa0a45ca11924e4aa8073f172c9470abc07
SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKr:eenet
TLSH
T1DEC3F7075EB18CEBD801043A57FAA22D86EBBC440DECE257D7DDDC4634D2918C86EA57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery blihanstealer persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

Family: BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/4572-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000a00000001b315-4.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4572-6-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2132-8-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1092-9-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Deletes itself 1 IoCs

pid	Process
1092	microsofthelp.exe

Executes dropped EXE 2 IoCs

pid	Process
1092	microsofthelp.exe
2132	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	2026-08-01_f420ea0c3677ad56b494194686c43391_elex_qilin_rhadamanthys.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe
File created	C:\Windows\microsofthelp.exe	2026-08-01_f420ea0c3677ad56b494194686c43391_elex_qilin_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_f420ea0c3677ad56b494194686c43391_elex_qilin_rhadamanthys.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1092	4572	2026-08-01_f420ea0c3677ad56b494194686c43391_elex_qilin_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_f420ea0c3677ad56b494194686c43391_elex_qilin_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_f420ea0c3677ad56b494194686c43391_elex_qilin_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1092

C:\Windows\microsofthelp.exe
C:\Windows\microsofthelp.exe
1⤵
- Executes dropped EXE
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 118KB
SHA256 c0954663c1865f350af032ec580f1b53fd86e7804ba88b8165a11b5678c6135f
MD5 6de0125bb312b91620192cddaf05c39d
SHA1 de4912944afd5677787b0a6d48cb28ed2153aa85
SHA512 f6617e9d0af875e79b26d58cfc512465a28b4bacf6ec79c33db3318ff9b2eb5ba6a7150ea18cc999595e0292021874f894f95809c55e4a5136a3aabababf3453
SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hK/:eenet
TLSH
T15FC3F7075EB18CEBD801043A57FAA22D86EBBC440DECE257D7DDDC4634D2918C8AEA57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-9-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2132-8-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4572-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4572-6-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads