blakcsee_stealer | d4f9162b215edba728049598da29797033a3af0afe332a9b332a88f146796f79

Sharing

Copy URL Twitter E-mail

General

Target
esp4valorant1pcweb0-3.40.2.zip
Size 124.1MB
Sample260809-w8b3eswzcy
SHA256 d4f9162b215edba728049598da29797033a3af0afe332a9b332a88f146796f79
MD5 431dea094375405c25d685053a95b703
SHA1 6e1d8d2c9b61e56890c457d4efdb72f68d75caa3
SHA512 c5e77c9134006669a5112c08ba7c9e1351d4b1c3feb92990e84797f96c13680e1a88d392d6d7778db023c6fc4b3321c337c6babfceaabf935aa95f87d8f6c9ee
SSDEEP 3145728:SV6zkXQCSr8Hcbgpa5g8Inu45LiuZXrIVDW:Sm7r8HcbQJuQug
TLSH
T1EB581242F4619799C021B1F444DBBA9DF1213C6143380EE3A7605EAE1EBB7C4763BAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  esp4valorant1pcweb0-3.40.2.zip
- Size 124.1MB
- SHA256 d4f9162b215edba728049598da29797033a3af0afe332a9b332a88f146796f79
- MD5 431dea094375405c25d685053a95b703
- SHA1 6e1d8d2c9b61e56890c457d4efdb72f68d75caa3
- SHA512 c5e77c9134006669a5112c08ba7c9e1351d4b1c3feb92990e84797f96c13680e1a88d392d6d7778db023c6fc4b3321c337c6babfceaabf935aa95f87d8f6c9ee
- SSDEEP 3145728:SV6zkXQCSr8Hcbgpa5g8Inu45LiuZXrIVDW:Sm7r8HcbQJuQug
- TLSH
  T1EB581242F4619799C021B1F444DBBA9DF1213C6143380EE3A7605EAE1EBB7C4763BAD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Aggreement.txt
- Size 6KB
- SHA256 6002acf2f7e09112111a39b149b0b3ec3d4eead87d2fafbae8ecf8b8d85c8282
- MD5 49a981ef603df6993fc19f5c1042c135
- SHA1 ffe1db4ceea299c7b88eeba6236cc634cea00457
- SHA512 a717362554cf23371c9e304457df553d09dd16782193a12b02dc769901e6e42a084140eff7f8380211a71dd3c7be5a69ab5017adcb62f3c32a45bd1c038fb7bd
- SSDEEP 192:Dqmp8oexXBebGulgRHumb3hpaEuMISHON:DqeehB+2djpa9MI1N
- TLSH
  T1BBD1C6A5378A03A50ACF01516B0B5084F66AC13E71AE56E572AC514C33FB16D83FE39F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  DeltaEncryptor.dll
- Size 18.0MB
- SHA256 4a4e26055b333841407534cc11d852a1e358bf9289f89ba97f94a9d073ecefca
- MD5 35ee631a8cc3580e4d197c11d12f4ade
- SHA1 74b64f23b730d856e8647f9aaceaa5424a872891
- SHA512 d900433dd7a00256621293a9075b4284d82b950c15779d3ab8a9a3d8bdc7e146986756ba5f1c1380637bb3197e110108910217fe5ff9872c4a4927c6677a288f
- SSDEEP 98304:WLKaY/Ofme4k2LALs1Qw8CWhvfrcMMMMMMMA5cMMMMMMMG9MMMMMMM8jzv16bTEI:sY/Oj45/11CEM3jzCyS
- TLSH
  T184177B83F8619B9AC41074F404DBB99CE1162CA4403C0EB3A7646EEE1EFF75876179E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  FusionProcessor.dll
- Size 95.8MB
- SHA256 8f718aaf34ed3fdcb8bd8d7d538495d0a79c9985abf972953002a54398180f6b
- MD5 79e75adc03134db1e3b94bcd2beaea9e
- SHA1 e62112217f82d02a9139ae2a28f9d95f71d5d1d8
- SHA512 4f9c947813f5637d9530ceb41476051c5c05cfa95a374415d487dbb3babe776f3fc1c6dfea336e64d399efb2d318b0eb99363ec1ec5d7af0eff114536a1b4314
- SSDEEP 1572864:atkXzkCSrUtVBcbDMpiEeVrK7n9i3IPe+u/bbcNH59BiuZ2S71BKjVDBTs:ikXQCSr8Hcbgpa5g8Inu45LiuZXrIVDq
- TLSH
  T1742833132889C7A6E6BEDE61B23035C9255AC5E70129EEF16A7C4493CC0494FAF0D7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  esp4valorant1pcweb0-3.40.2.exe
- Size 22KB
- SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
- MD5 41ad4cb04af8def70763d895973584e2
- SHA1 24fd6c86360d98e565bc7f3a6aa8165bc34c325f
- SHA512 db3e871cc646eeab7eb2bbeceb323f0951199ea698f91eaa5eec367e48b461748c472867383560c22bce5cba1d4f09fb25983a92f219c867e8fd40d0c53bb43e
- SSDEEP 384:gMoZapK5vwxSYjWAlaWFOSxE1+aHRN7t0jHvDyR9zv:gnZaBgyEN+2t0rD+9z
- TLSH
  T1FFA27C9ADA78058BF8EA18B08279E98BBC3DB7D31B5092CB0354E6181D137C5FA3475D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral9
- Target
  github-icon.png
- Size 22KB
- SHA256 17eba628a7dda862d236bca66899be4b80c02c57244f0fbaca573f31740ef730
- MD5 f0fca642b1b10c65c5388d54264df46a
- SHA1 2827ddafa45d9aad3c54f4ff581d046699e015fa
- SHA512 48d09410cba82a923efc3974c98d77afea09a92bdeac603cb2439f8dcd033a863c59ffa3260abb4f9595d3fc2bff1718f627db96c695b6cf700dd910348795c2
- SSDEEP 384:kagku6S2KQRNMvWsx5IK12VpYArX/JpZx3vag01/TqWrZy7sL4nGCOmWW6j0sBJ/:kagkur2KQRhYIZVbrj3ELfJL8GS6oGJ/
- TLSH
  T15BA2DF617E58A481D72F6DF2FD94CA91AB0E180D46584C93A20AE678F7C6D3CDC9070B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  github.txt
- Size 20B
- SHA256 fa7a9db4c01521fe80f772fb61ae421dfb09965c984ec72de8a84239e7367ded
- MD5 9d34f7f2ebf391a520ccdf6b3ba5aae6
- SHA1 1391c88ce6408adf696865633b922137ba43e1b4
- SHA512 14a7107bd8de39762d6f8e49f14c6463c95724d2d2db266e391cb94d8247b17960ae127929daf7e18df3f450744f82be8b3b40a5a9bdfd40dc203d8d0e1f4ae5
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral12 behavioral13
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  vsdbg.dll
- Size 3.3MB
- SHA256 a72a8533726ff9676614b47cc0301177e9b68769b97ca86e2fc214788767390e
- MD5 70238f34192770b683ac450ccd11b434
- SHA1 c9b1efc848580b2079adcd3e0d23423117194005
- SHA512 eab801d9ed92913338d7e00ed140a91bd3d66212743da3a90d2f6d3f30f15949c22fe09b65308a99aea592b440f6b145f5e9cfba453b1f6ac674d545d85be4ad
- SSDEEP 98304:z3Yspbo8fIMr6xz+uTQVwc7fJBFVFO30ER2MiP3wSiUsrYg9Frv4vXNrYQ031Cy:z31Hsxz+uUiUDnHMWwSiUsrYCoXK1
- TLSH
  T17EF5BF85B3C4AAD9C506DE3A9714F231C1B2B9234FB7E0CA5E97C70A4AB6D514F39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral21 behavioral22
- Target
  vsdebugeng.dll
- Size 3.6MB
- SHA256 076b2a9dd101f99e031a641150da8d12b03591d85a234dfe339a344026c2e587
- MD5 98e9aee8efbff4830c044712cf4fc885
- SHA1 a787b13b5629032e7f888d8013508d5a0d8ab7e1
- SHA512 bea86d4a87a518963b51e6ed4c31b65e823be57c2e1b87f72ffd29360e18e47659d4ef7df5fa6a4477029455f8c537484f0f2e3beb00b3df2c21a8d98871a0b6
- SSDEEP 49152:+UMZg766BnzEXC+ShVI8g6XOWhnPUJ1j2gE/:+sEChrZhn
- TLSH
  T1E4061942B656D0A5D07AF2788DDB9729FAB1B815CB2246C7B4E0472E7E673C0573B20C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  webservices.dll
- Size 1.4MB
- SHA256 8ec55086fbef306b38cf53be62166c70dc20ee3c46c6ef1afdbfb76805da2814
- MD5 6a97102fb451ef9cb7f8e415eddbcb14
- SHA1 2a70d43a64405a9f472a5a04e22344d117f11066
- SHA512 ecbe68289c76146c493fcfee628bdd3b0bf5c2ef5c1ebffba9eeba0a180c3bdca2c648b8abf61bb9e17f8760710e5f44b3b23345ca4bba9fb0ab4e2548b7a696
- SSDEEP 24576:mtlXI1EeOvW1JpHvaKLZ3gfqjldnKYTXo9eEAMyKVN:UX4EeOvW1JpyKLZQyjldnK6XocEYC
- TLSH
  T1B8657C1AA6A800E5C7FFD238C657862FDBF13425536057CF06648A796F23BE4963E318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24