blihanstealer | 0e2818a0713270d981299fd7b4468d1ff9efbb57acbfb9ce3d21d6eaa4a09888

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_fee2e520cc16359153401870351d1c60_elex_qilin_rhadamanthys.exe
Size 129KB
Sample260828-3tx5nstygt
SHA256 0e2818a0713270d981299fd7b4468d1ff9efbb57acbfb9ce3d21d6eaa4a09888
MD5 fee2e520cc16359153401870351d1c60
SHA1 08fa897d929f8ce49be5911d81d193aba7b881a7
SHA512 99a321642fe3b4f62a935ab0759e3061c4605ee4e8d1e54d479cd964c92c223a9cdab909bee4000dd261910ddb693209ba51be8ffa19551ca5c099892f60d84a
SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKp:eenet
TLSH
T153D3E70B5FA1CCDBD800043A57FAA22D86EBBD441DECE35697DDCC4634D2918C8AEA57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery blihanstealer persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Signatures

Family: BlihanStealer
Blihan is a stealer written in C++.
trojan stealer blihanstealer

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/404-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x001a0000000242f7-3.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/404-5-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/4220-7-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3044-8-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Deletes itself 1 IoCs

pid	Process
3044	microsofthelp.exe

Executes dropped EXE 2 IoCs

pid	Process
3044	microsofthelp.exe
4220	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	2026-08-28_fee2e520cc16359153401870351d1c60_elex_qilin_rhadamanthys.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe
File created	C:\Windows\microsofthelp.exe	2026-08-28_fee2e520cc16359153401870351d1c60_elex_qilin_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_fee2e520cc16359153401870351d1c60_elex_qilin_rhadamanthys.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3044	404	2026-08-28_fee2e520cc16359153401870351d1c60_elex_qilin_rhadamanthys.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-28_fee2e520cc16359153401870351d1c60_elex_qilin_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_fee2e520cc16359153401870351d1c60_elex_qilin_rhadamanthys.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3044

C:\Windows\microsofthelp.exe
C:\Windows\microsofthelp.exe
1⤵
- Executes dropped EXE
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 129KB
SHA256 47145780376dc145ce2413900c9169bafc39b1e31742b0824534ef45ca8d949e
MD5 a527e9adb84b2647b0b94f2f19836557
SHA1 a7f6824263bfe56cd8bcfba1ef6365744f70b6d6
SHA512 10eedff21298cb867055b1686e5b140c3df0d2fe5d434c09f2c4cd365377f590ec5a57dd36f2008781931cf6bee6a9dc82ef96b1e0b7701cbaee992cd76823b4
SSDEEP 3072:NAoglOwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKo:eenet
TLSH
T138D3D70B5FA1CCDBD800043A57FAA22D86EBBD441DDCE35697DDCC4634D2918C8AEA57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/404-5-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3044-8-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4220-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads