blihanstealer | 5f86ed66f23844aa8f6a7fe0341d974a086c950ebc4ee75c381ef954680d897d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_6a062bbb9c24d4cc71ce8ae5336786b1_elex_qilin.exe
Size 96KB
Sample260819-2nvxpavemc
SHA256 5f86ed66f23844aa8f6a7fe0341d974a086c950ebc4ee75c381ef954680d897d
MD5 6a062bbb9c24d4cc71ce8ae5336786b1
SHA1 d604476e02d9d7f3a956fbe4f1660904e0941ba1
SHA512 982b149374663f4bb54d085ebb3adcd0b61684ff7c3765a2125f73e910e5e5a3dd570a50a576088884cdfbf64a2f2675d184fe21bc4df8506931646f852ed64c
SSDEEP 3072:E1oEFlt6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKh2h7hWh:E6
TLSH
T14EA3B34B4E71CDDFE814143E9BAAA21C86D3FC541CCCF35A96EED84270C2918C99E967
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery blihanstealer persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

Family: BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/2828-0-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000600000001b853-4.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2828-6-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4948-9-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1388-10-0x0000000000400000-0x000000000040E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Deletes itself 1 IoCs

pid	Process
1388	microsofthelp.exe

Executes dropped EXE 2 IoCs

pid	Process
1388	microsofthelp.exe
4948	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	2026-08-19_6a062bbb9c24d4cc71ce8ae5336786b1_elex_qilin.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	2026-08-19_6a062bbb9c24d4cc71ce8ae5336786b1_elex_qilin.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_6a062bbb9c24d4cc71ce8ae5336786b1_elex_qilin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1388	2828	2026-08-19_6a062bbb9c24d4cc71ce8ae5336786b1_elex_qilin.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_6a062bbb9c24d4cc71ce8ae5336786b1_elex_qilin.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_6a062bbb9c24d4cc71ce8ae5336786b1_elex_qilin.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1388

C:\Windows\microsofthelp.exe
C:\Windows\microsofthelp.exe
1⤵
- Executes dropped EXE
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 97KB
SHA256 a322d41f35257baa7770f507cf3dbce02c85896d5c0fea3473ad376f2b8469eb
MD5 b81061a0d75e0ebd3df686a900b76c00
SHA1 a132fa3f138a97672eb090711487141e40b6608c
SHA512 d6194f19cc8532b864f6f7f0d078944e6b9d3d3c0335e621e74a0c2732afa7a94b46bf7182feab996d7d0cbe804a486661f98101aebe15dfad43ef6c84137916
SSDEEP 3072:E1oEFlt6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKh2h7hWhF:E6
TLSH
T131A3B44B4E71CDDFE814143E9BAAA21C86D3FC541CCCF35A96DED84270C2918C99E967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1388-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2828-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2828-6-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4948-9-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads