blihanstealer | 78CDFF59E7AEBA10[.]zip

General

Target
78CDFF59E7AEBA10.zip
Size 21KB
Sample260807-tsbevazbkd
SHA256 7b531e1c259d81cccf2feb3fdfcc0cc30f2a8b0ae17da4980d4da795e9c71bfd
MD5 3a2094310fb184ed9b31270f8f7d4667
SHA1 76260160853479c12ff7742949268adb18ae4a06
SHA512 85b3e5645cfc802552dd5134f82052c5207289c7316c9421cc80c58d02c902ef6ceeec10c6d4c75f562317a975448e47b6ae4c34801dc9578efde2631ae37d72
SSDEEP 384:MFcowvkdyN+wpZ/UHCMRuNbJTUYH4/G72GpDwd0gsofZLNt+RpmC:4Y4gFZ/+CMc9JTUYY+7zwd4ofZLNtSpB
TLSH
T1FDA2E18FB6896C7BFB4F3413F46B937E65091BD1A54738980789384FC419A261B78097
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan stealer blihanstealer

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

Family: BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/05353c0f71a543d63110088daf17432d752c7c4dc8656a3fdd5796f0b22d4b2b

File Explorer

78CDFF59E7AEBA10.zip

.zip 21KB
05353c0f71a543d63110088daf17432d752c7c4dc8656a3fdd5796f0b22d4b2b

.exe 56KB

78CDFF59E7AEBA10.zip

SHA256 7b531e1c259d81cccf2feb3fdfcc0cc30f2a8b0ae17da4980d4da795e9c71bfd
MD5 3a2094310fb184ed9b31270f8f7d4667
SHA1 76260160853479c12ff7742949268adb18ae4a06
SHA512 85b3e5645cfc802552dd5134f82052c5207289c7316c9421cc80c58d02c902ef6ceeec10c6d4c75f562317a975448e47b6ae4c34801dc9578efde2631ae37d72
SSDEEP 384:MFcowvkdyN+wpZ/UHCMRuNbJTUYH4/G72GpDwd0gsofZLNt+RpmC:4Y4gFZ/+CMc9JTUYY+7zwd4ofZLNtSpB
TLSH
T1FDA2E18FB6896C7BFB4F3413F46B937E65091BD1A54738980789384FC419A261B78097
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

05353c0f71a543d63110088daf17432d752c7c4dc8656a3fdd5796f0b22d4b2b

SHA256 05353c0f71a543d63110088daf17432d752c7c4dc8656a3fdd5796f0b22d4b2b
MD5 24d2e808e3e64929b153bab7f0109977
SHA1 e54163ff75f702240c83c42b886ea6a211c96c57
SHA512 6a87b58f2ef356962ba8723a864c0f90e771e510c91260b27f40ee85b1e13fb14b2815338ce724673d96a2a1bd63154ddcae49e589f1352ccffc6736fc1ca296
SSDEEP 384:1x2KzC6+1ihcz/A78FBPgy/pYQdm7HZp9zO0gWRqpd+/rhBbx0A0kHQYp:g6wTz/A780ap/iHZplRRqpd6rnxni
TLSH
T18843AF2378D68133E5D1027204A99B799B3F3D422FF055C7DB98DA1E2E365D09E3A287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

53582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Sharing