blakcsee_stealer | a0d48ced84a2a4d8fcd0f082e4cd4b0b9ceb777176da89222192811796621492

Sharing

Copy URL Twitter E-mail

General

Target
Peace-Equalizer-Apo-8.78.9.zip
Size 133.4MB
Sample260809-pfgnwaxdnc
SHA256 a0d48ced84a2a4d8fcd0f082e4cd4b0b9ceb777176da89222192811796621492
MD5 af8a0d9248da9ad129bc42db02e10e05
SHA1 2403b0c922c377ad9920201c87e3264f7b74023c
SHA512 6e7074e45dbaecd43384e69d6e20febae08d6eb88c6e291804aedb061d96070a11607ddcee99c2dbd50c5595ebafac1d81520b3cb8cc874b916136cd374532b1
SSDEEP 3145728:SBl0YpnH8gkXQCSr8Hcbgpa5g8Inu45LiuZXrIVDgRWsLQ2Kj:SBl0jg7r8HcbQJuQu6R7L2j
TLSH
T187683346B29985D5D07AE238CA979336E6B2B8154B3252C775EC871E6F377C04B3E308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

blakcsee_stealer

94.183.168.16

Targets

- Target
  FusionProcessor.dll
- Size 95.8MB
- SHA256 8f718aaf34ed3fdcb8bd8d7d538495d0a79c9985abf972953002a54398180f6b
- MD5 79e75adc03134db1e3b94bcd2beaea9e
- SHA1 e62112217f82d02a9139ae2a28f9d95f71d5d1d8
- SHA512 4f9c947813f5637d9530ceb41476051c5c05cfa95a374415d487dbb3babe776f3fc1c6dfea336e64d399efb2d318b0eb99363ec1ec5d7af0eff114536a1b4314
- SSDEEP 1572864:atkXzkCSrUtVBcbDMpiEeVrK7n9i3IPe+u/bbcNH59BiuZ2S71BKjVDBTs:ikXQCSr8Hcbgpa5g8Inu45LiuZXrIVDq
- TLSH
  T1742833132889C7A6E6BEDE61B23035C9255AC5E70129EEF16A7C4493CC0494FAF0D7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  NovaInterface.dll
- Size 27.2MB
- SHA256 87e4292dc9aa91a2020aaedd02a11518cefcdfeb03c2b0aa6944dd71f43f24db
- MD5 9b7b594ab6d00f57615e4a2b1997ed79
- SHA1 f69219d36c0797de6313204e28b333739ff6d726
- SHA512 f426e810e514357e1f7a57f183d7113fc1ce71454967a3ade8fc6d1a8e675befe3635cab203dec626b8e370e56f68c3094b5190b33d80205141871aa130fd656
- SSDEEP 786432:WDN3vWAxiKjt3YU1eFTIbkbpRwladeZlKMH:oN/Waic3YygFRndMKE
- TLSH
  T15557334D995B48CA23B62A099AB9F264C263D1DC1E3328577C5C9449FFB286CC8F05DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Peace-Equalizer-Apo-8.78.9.exe
- Size 22KB
- SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
- MD5 41ad4cb04af8def70763d895973584e2
- SHA1 24fd6c86360d98e565bc7f3a6aa8165bc34c325f
- SHA512 db3e871cc646eeab7eb2bbeceb323f0951199ea698f91eaa5eec367e48b461748c472867383560c22bce5cba1d4f09fb25983a92f219c867e8fd40d0c53bb43e
- SSDEEP 384:gMoZapK5vwxSYjWAlaWFOSxE1+aHRN7t0jHvDyR9zv:gnZaBgyEN+2t0rD+9z
- TLSH
  T1FFA27C9ADA78058BF8EA18B08279E98BBC3DB7D31B5092CB0354E6181D137C5FA3475D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral3
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  vsdbg.dll
- Size 3.3MB
- SHA256 173a9aba054121c8642d46330a99037b6d13455b07b312130ad9c68afd93914f
- MD5 7493dbfd016e62ab2fdfb32420d4554e
- SHA1 6ee9c5ab525cfce93e2bedcf07b4373c42ed36c8
- SHA512 fa4ec8e816adf19ef3b1d7ca6ae3abb0d01a2812877dd7366432a7fa026da71d8e49a5090a911ad800f72c325889c3e3cc2935a5d9f552630c75d31dfc752e04
- SSDEEP 98304:PUdVeVQnwWoI4N9DXQpOuodDwO9WnhW1v3f9I/2ELhJNJizXGEe76/6a3plBjF8q:PUEQLolN9kpiwOyOu/2SlJir/eOz7ZFn
- TLSH
  T1D4F5BF85B3C4AAD9C146DD3A9714F232C1B2B9234FB6D0CA5E97C70A4ABAD514F3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral8
- Target
  vsdebugeng.dll
- Size 3.6MB
- SHA256 076b2a9dd101f99e031a641150da8d12b03591d85a234dfe339a344026c2e587
- MD5 98e9aee8efbff4830c044712cf4fc885
- SHA1 a787b13b5629032e7f888d8013508d5a0d8ab7e1
- SHA512 bea86d4a87a518963b51e6ed4c31b65e823be57c2e1b87f72ffd29360e18e47659d4ef7df5fa6a4477029455f8c537484f0f2e3beb00b3df2c21a8d98871a0b6
- SSDEEP 49152:+UMZg766BnzEXC+ShVI8g6XOWhnPUJ1j2gE/:+sEChrZhn
- TLSH
  T1E4061942B656D0A5D07AF2788DDB9729FAB1B815CB2246C7B4E0472E7E673C0573B20C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  webservices.dll
- Size 1.4MB
- SHA256 8ec55086fbef306b38cf53be62166c70dc20ee3c46c6ef1afdbfb76805da2814
- MD5 6a97102fb451ef9cb7f8e415eddbcb14
- SHA1 2a70d43a64405a9f472a5a04e22344d117f11066
- SHA512 ecbe68289c76146c493fcfee628bdd3b0bf5c2ef5c1ebffba9eeba0a180c3bdca2c648b8abf61bb9e17f8760710e5f44b3b23345ca4bba9fb0ab4e2548b7a696
- SSDEEP 24576:mtlXI1EeOvW1JpHvaKLZ3gfqjldnKYTXo9eEAMyKVN:UX4EeOvW1JpyKLZQyjldnK6XocEYC
- TLSH
  T1B8657C1AA6A800E5C7FFD238C657862FDBF13425536057CF06648A796F23BE4963E318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10