blihanstealer | 50732b18e6280bca4a09dc7e0c72f5045aa1358a0b7d44ce400272af2c0fefa3

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_3f9d0febc24c9c4707e31d223ca6b30c_elex_qilin.exe
Size 92KB
Sample260809-3147kafp3y
SHA256 50732b18e6280bca4a09dc7e0c72f5045aa1358a0b7d44ce400272af2c0fefa3
MD5 3f9d0febc24c9c4707e31d223ca6b30c
SHA1 7ca464e7a353e0a7225cc5da7cca6b4f70204fdc
SHA512 ef07e70971d35af24eb27416122961889a600a2b7a4f6d6d0f68bbff2f9c890ddf8df8bc389ee5263de0460b4eb7ce8c65ba5206b3c34cd8cf3a5c20adaf1bbe
SSDEEP 1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+h+hhjhkhMh8hy:E1oEFlt6vghzwYu7vih9GueIh9j2IoHh
TLSH
T1A593D34B4E61CDDBD804103BABEAA21C86E3FC456DDCF35557EEC80670C2918C89E997
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery blihanstealer persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

Family: BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/3704-0-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000019ce0-4.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3704-6-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1412-9-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3944-10-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Deletes itself 1 IoCs

pid	Process
3944	microsofthelp.exe

Executes dropped EXE 2 IoCs

pid	Process
3944	microsofthelp.exe
1412	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	2026-08-09_3f9d0febc24c9c4707e31d223ca6b30c_elex_qilin.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	2026-08-09_3f9d0febc24c9c4707e31d223ca6b30c_elex_qilin.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_3f9d0febc24c9c4707e31d223ca6b30c_elex_qilin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3944	3704	2026-08-09_3f9d0febc24c9c4707e31d223ca6b30c_elex_qilin.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-09_3f9d0febc24c9c4707e31d223ca6b30c_elex_qilin.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_3f9d0febc24c9c4707e31d223ca6b30c_elex_qilin.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3944

C:\Windows\microsofthelp.exe
C:\Windows\microsofthelp.exe
1⤵
- Executes dropped EXE
PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 93KB
SHA256 a015211b93d97deda8c72becd83814b33362afc0b81c8120b251fa24ca14c36e
MD5 47d4ece0568dde682c01317a1f5e4964
SHA1 4ed44a37a39da778268a958cd5f3f0e3cb15ec86
SHA512 0dc0fd7dd6d2f61d6171cd3efa575b2bc25d809fdd4c12c54e1a6381584a710961bc0e1333be11c98dd56cbc75ef3d09ffc35c172e7a6295b23619dc767ce69b
SSDEEP 1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+h+hhjhkhMh8hN:E1oEFlt6vghzwYu7vih9GueIh9j2IoHu
TLSH
T19093C34B4EA1CDDBD804103BABEAA21C86E3FC456DDCF35557EEC80670C2918C99E957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-9-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3704-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3704-6-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3944-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads