blakcsee_stealer | 73215433d47481d2a37483c474d30ebe27504728b7b8e2eaa5c67ca4755dcd8d

Sharing

Copy URL Twitter E-mail

General

Target
11082026_1025_10082026_Уведомление №43 от 10.08.2026.rar
Size 4.1MB
Sample260811-mf433acl51
SHA256 73215433d47481d2a37483c474d30ebe27504728b7b8e2eaa5c67ca4755dcd8d
MD5 34467f21a5c994bddc6b9ab7c652282d
SHA1 4260980923e75924783c2ff6f85b70306bed0e0e
SHA512 d832e58987168e9ed9320c064155b59711a1deab4431ec04f8e883e5d58757f8cabc7ccb06b53d114239f6fb9884aec2b91ef2f4e2106c1fdaa5552d39f4a83a
SSDEEP 98304:SZQw7NZOGmSFVliHfJY4OEj+QP+2CUcVV/zONi/VoK+hysH0s:SZzAGP3IP7H+2HcVZOEtsHf
TLSH
T1451633AE3BA67034B5E00A555F1B4A0475443A75AE48C38AF4EE8CF5DB36FEA0C6C171
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  vsdbg.dll
- Size 4.1MB
- SHA256 020798dc4cfbf5a7b3af668488a43b4ae4d9674294ee98fb558b98b05540204c
- MD5 3e1e8aa8f19e7eec889d4f09880e1f41
- SHA1 27d8b132eb592b4288ddda15a4130a002d32640b
- SHA512 ef4e75d044beffe8d6785b82a344c2ec0d1f83d3edca90617bd1f4b3f8b9bd71bda214df02825d920247cc06a4b06f5a41b65dc0d194a46e5156cf8df4c61a68
- SSDEEP 98304:XnZxe5BDwtuYtvbdaDDDHwYskSrwvr9fsVYv3YWt9QRjmmizY1wy8lUIlbcKOWm7:XnZw5R0vbYnDH1skEWZfsh4CmmuVH0QC
- TLSH
  T16C16B096B3C47AD9C146DD3A9714F23281A3A9338EB7D0CA5E97C70A4AB6D514F38F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral8 behavioral9
- Target
  vsdbg.exe
- Size 22KB
- SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
- MD5 41ad4cb04af8def70763d895973584e2
- SHA1 24fd6c86360d98e565bc7f3a6aa8165bc34c325f
- SHA512 db3e871cc646eeab7eb2bbeceb323f0951199ea698f91eaa5eec367e48b461748c472867383560c22bce5cba1d4f09fb25983a92f219c867e8fd40d0c53bb43e
- SSDEEP 384:gMoZapK5vwxSYjWAlaWFOSxE1+aHRN7t0jHvDyR9zv:gnZaBgyEN+2t0rD+9z
- TLSH
  T1FFA27C9ADA78058BF8EA18B08279E98BBC3DB7D31B5092CB0354E6181D137C5FA3475D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blakcsee_stealer stealer
- Family: BlakcSeeStealer
  BlakcSeeStealer is a Windows stealer written in C++.
  stealer blakcsee_stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral10
- Target
  vsdebugeng.dll
- Size 3.6MB
- SHA256 076b2a9dd101f99e031a641150da8d12b03591d85a234dfe339a344026c2e587
- MD5 98e9aee8efbff4830c044712cf4fc885
- SHA1 a787b13b5629032e7f888d8013508d5a0d8ab7e1
- SHA512 bea86d4a87a518963b51e6ed4c31b65e823be57c2e1b87f72ffd29360e18e47659d4ef7df5fa6a4477029455f8c537484f0f2e3beb00b3df2c21a8d98871a0b6
- SSDEEP 49152:+UMZg766BnzEXC+ShVI8g6XOWhnPUJ1j2gE/:+sEChrZhn
- TLSH
  T1E4061942B656D0A5D07AF2788DDB9729FAB1B815CB2246C7B4E0472E7E673C0573B20C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  webservices.dll
- Size 1.4MB
- SHA256 8ec55086fbef306b38cf53be62166c70dc20ee3c46c6ef1afdbfb76805da2814
- MD5 6a97102fb451ef9cb7f8e415eddbcb14
- SHA1 2a70d43a64405a9f472a5a04e22344d117f11066
- SHA512 ecbe68289c76146c493fcfee628bdd3b0bf5c2ef5c1ebffba9eeba0a180c3bdca2c648b8abf61bb9e17f8760710e5f44b3b23345ca4bba9fb0ab4e2548b7a696
- SSDEEP 24576:mtlXI1EeOvW1JpHvaKLZ3gfqjldnKYTXo9eEAMyKVN:UX4EeOvW1JpyKLZQyjldnK6XocEYC
- TLSH
  T1B8657C1AA6A800E5C7FFD238C657862FDBF13425536057CF06648A796F23BE4963E318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

Family: BlakcSeeStealer

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12