Overview

overview

10

Static

static

5

GammaCompressor.dll

windows10-2004-x64

1

GammaCompressor.dll

windows11-ltsc_2024-x64

1

SecureAccess.dll

windows10-2004-x64

1

SecureAccess.dll

windows11-ltsc_2024-x64

1

esp4valora....1.exe

windows10-2004-x64

10

vsdbg.dll

windows10-2004-x64

10

vsdbg.dll

windows11-ltsc_2024-x64

10

vsdebugeng.dll

windows10-2004-x64

1

webservices.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    esp4valorant1pcweb0-5.16.1.zip
  • Size 123.2MB
  • Sample260823-bjd59swvey
  • SHA256 32c6c73992826543a477fec483c430636f65a263b719d27f2747d5a2b56fe7c4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blakcsee_stealerdiscoverystealer

Malware Config

Extracted

Family

  • blakcsee_stealer

C2

  • 2.26.126.50

Targets

    • Target
      GammaCompressor.dll
    • Size 17.9MB
    • SHA256 1967372e097a2ab2ce8f99fdad4f3637da398379090cd5eb110f3735e7b36a96
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      SecureAccess.dll
    • Size 95.9MB
    • SHA256 5cf424c592dd97d4d93d757959eae80a559f49d8610cf89c334ac139e67df645
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      esp4valorant1pcweb0-5.16.1.exe
    • Size 22KB
    • SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryblakcsee_stealerstealer

    • Family: BlakcSeeStealer

      BlakcSeeStealer is a Windows stealer written in C++.

      stealerblakcsee_stealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Suspicious use of SetThreadContext

    behavioral5
    • Target
      vsdbg.dll
    • Size 4.3MB
    • SHA256 549fb209c929c7f4352c05f360ad5d77d10994c8bdd1b09a68cea296f41cad98
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryblakcsee_stealerstealer

    • Family: BlakcSeeStealer

      BlakcSeeStealer is a Windows stealer written in C++.

      stealerblakcsee_stealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Suspicious use of SetThreadContext

    behavioral6behavioral7
    • Target
      vsdebugeng.dll
    • Size 3.6MB
    • SHA256 076b2a9dd101f99e031a641150da8d12b03591d85a234dfe339a344026c2e587
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      webservices.dll
    • Size 1.4MB
    • SHA256 8ec55086fbef306b38cf53be62166c70dc20ee3c46c6ef1afdbfb76805da2814
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9

MITRE ATT&CK Enterprise v16

Tasks