blakcsee_stealer | b7ef06eb605f278626628a7b0c1d6b427b15e120be4bbfbb60166ff2b6ffc28b

Sharing

Copy URL Twitter E-mail

General

Target
graphicsgale-pixel-art-6.12.9.zip
Size 122.5MB
Sample260808-q3vppaxgrc
SHA256 b7ef06eb605f278626628a7b0c1d6b427b15e120be4bbfbb60166ff2b6ffc28b
MD5 b8c8abda67dac5296d65dc48e11d2b52
SHA1 fc90d965af5366543ebbf7937ac8cdd65f2808db
SHA512 8c4eac56840911a885142c7b12e3d94ffa51098307716ef87f5f6fe2832586c5b9c2f744b53ba936e89bcb5afd9b8e8518bc6dcee3cd919e92a74c0493c64552
SSDEEP 3145728:tV6T3S3Nm3uKRTZNy5kCf/nFSxgQ9JaDRWsLQ2KQ:t+3mm3uylNWkCffFSxgQ90DR7L2Q
TLSH
T16F583345B29944D5C0BAE238CE979335E6B2B8158B3252CB75EC871E2F777D05B3A308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NeuralEngine.dll
- Size 84.9MB
- SHA256 a1b8b60a03a216c261442a37f27f6c09e40f9980c97a4f3eecdb1f61eeb8ff35
- MD5 1ca916f3f259691b0f32861d51fe9880
- SHA1 c6f6fb452fcd51faecbbcdfc3bf7836ebb2fe92d
- SHA512 d2df45a1965f2f4547664ac9fe3b98912b324232f01184a6a4f07e22da5f95bee237caabb8e5a490834bca77a9e687a0bac329f6895e9bf2c2a6ec95e1821a54
- SSDEEP 1572864:V3S3T7aoyp3257Kg4g+QwTZNz+5YtJgfyKxu2/F4HxgQJ3rJbmr+V:V3S3Nm3uKRTZNy5kCf/nFSxgQ9Jas
- TLSH
  T1681833C28AAA3757C9D31029B7528B40B1DF7C92D3F2E0DDA2D93F1508985B4BDE860D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  NovaInterface.dll
- Size 27.2MB
- SHA256 87e4292dc9aa91a2020aaedd02a11518cefcdfeb03c2b0aa6944dd71f43f24db
- MD5 9b7b594ab6d00f57615e4a2b1997ed79
- SHA1 f69219d36c0797de6313204e28b333739ff6d726
- SHA512 f426e810e514357e1f7a57f183d7113fc1ce71454967a3ade8fc6d1a8e675befe3635cab203dec626b8e370e56f68c3094b5190b33d80205141871aa130fd656
- SSDEEP 786432:WDN3vWAxiKjt3YU1eFTIbkbpRwladeZlKMH:oN/Waic3YygFRndMKE
- TLSH
  T15557334D995B48CA23B62A099AB9F264C263D1DC1E3328577C5C9449FFB286CC8F05DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  graphicsgale-pixel-art-6.12.9.exe
- Size 22KB
- SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
- MD5 41ad4cb04af8def70763d895973584e2
- SHA1 24fd6c86360d98e565bc7f3a6aa8165bc34c325f
- SHA512 db3e871cc646eeab7eb2bbeceb323f0951199ea698f91eaa5eec367e48b461748c472867383560c22bce5cba1d4f09fb25983a92f219c867e8fd40d0c53bb43e
- SSDEEP 384:gMoZapK5vwxSYjWAlaWFOSxE1+aHRN7t0jHvDyR9zv:gnZaBgyEN+2t0rD+9z
- TLSH
  T1FFA27C9ADA78058BF8EA18B08279E98BBC3DB7D31B5092CB0354E6181D137C5FA3475D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral3
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  vsdbg.dll
- Size 3.3MB
- SHA256 a72a8533726ff9676614b47cc0301177e9b68769b97ca86e2fc214788767390e
- MD5 70238f34192770b683ac450ccd11b434
- SHA1 c9b1efc848580b2079adcd3e0d23423117194005
- SHA512 eab801d9ed92913338d7e00ed140a91bd3d66212743da3a90d2f6d3f30f15949c22fe09b65308a99aea592b440f6b145f5e9cfba453b1f6ac674d545d85be4ad
- SSDEEP 98304:z3Yspbo8fIMr6xz+uTQVwc7fJBFVFO30ER2MiP3wSiUsrYg9Frv4vXNrYQ031Cy:z31Hsxz+uUiUDnHMWwSiUsrYCoXK1
- TLSH
  T17EF5BF85B3C4AAD9C506DE3A9714F231C1B2B9234FB7E0CA5E97C70A4AB6D514F39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral8
- Target
  vsdebugeng.dll
- Size 3.6MB
- SHA256 076b2a9dd101f99e031a641150da8d12b03591d85a234dfe339a344026c2e587
- MD5 98e9aee8efbff4830c044712cf4fc885
- SHA1 a787b13b5629032e7f888d8013508d5a0d8ab7e1
- SHA512 bea86d4a87a518963b51e6ed4c31b65e823be57c2e1b87f72ffd29360e18e47659d4ef7df5fa6a4477029455f8c537484f0f2e3beb00b3df2c21a8d98871a0b6
- SSDEEP 49152:+UMZg766BnzEXC+ShVI8g6XOWhnPUJ1j2gE/:+sEChrZhn
- TLSH
  T1E4061942B656D0A5D07AF2788DDB9729FAB1B815CB2246C7B4E0472E7E673C0573B20C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  webservices.dll
- Size 1.4MB
- SHA256 8ec55086fbef306b38cf53be62166c70dc20ee3c46c6ef1afdbfb76805da2814
- MD5 6a97102fb451ef9cb7f8e415eddbcb14
- SHA1 2a70d43a64405a9f472a5a04e22344d117f11066
- SHA512 ecbe68289c76146c493fcfee628bdd3b0bf5c2ef5c1ebffba9eeba0a180c3bdca2c648b8abf61bb9e17f8760710e5f44b3b23345ca4bba9fb0ab4e2548b7a696
- SSDEEP 24576:mtlXI1EeOvW1JpHvaKLZ3gfqjldnKYTXo9eEAMyKVN:UX4EeOvW1JpyKLZQyjldnK6XocEYC
- TLSH
  T1B8657C1AA6A800E5C7FFD238C657862FDBF13425536057CF06648A796F23BE4963E318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10