Extracted

• • Target
    Antares Auto-Tune 8.1.1, 6.0.9, AVOX Evo 3.0.2 NO INSTALL.exe
  • Size 25.7MB
  • SHA256 81afff2dd7e82413a8ccc612c4bb2056e1f7df4e2ebb3cc9b6286be0c0338d90
  • MD5 c95638c16c81c319459970ccb77110c4
  • SHA1 5fc6e2a415aeec4532c5246c9080021e3275bcbb
  • SHA512 8a3673681ef8171e5c53823ed846dc404df766c182418e7529b5aa573b8c3f4cd75be522aa175d0866b0911a70b180a0cc03f8ab513a06adac09fe8a40052804
  • SSDEEP 393216:IKg93F20Ek7fH7LzAGSS4BESkQsv66BKGyb3XY5qAk0KUA4R3KojYyOBclCsTHGH:ZgNvNbAVx/yBobnY53tA4xK3y2OCQyr
  • TLSH
    T18347331D6F90C075D732AA72A8F0A2FB66D2B5214F75A303D48DEE7D38690B6F3105A1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionblakcsee_stealerinstallerpersistenceransomwarestealer

  • Family: BlakcSeeStealer

    BlakcSeeStealer is a Windows stealer written in C++.

    stealerblakcsee_stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1