blihanstealer | ef8faf234ea6bca8b36538f75139651a7440533175d80c0489b2dfe3d0f4ca0b | Triage™

Login
Reports

Overview

overview

Static

static

ef8faf234e...0b.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
ef8faf234ea6bca8b36538f75139651a7440533175d80c0489b2dfe3d0f4ca0b
Size 92KB
Sample260830-1egg9ssvgz
SHA256 ef8faf234ea6bca8b36538f75139651a7440533175d80c0489b2dfe3d0f4ca0b
MD5 0d4117f77f6ddfa38198865b53c1aa1d
SHA1 2fcee8e96319b9613eb5fa982100b8a5b64d7dba
SHA512 63a1ae1b210c0f07d78dc9e144592ae28ffa946d82e6363887f11f7537d799f58b0c8ef3c401babd50615d71b1825ad8fa930cad477ed2127ac13e1b5c3c4ec1
SSDEEP 1536:vAowfbJFgjQ284U+w2EwRzSIUqhwDKopH0njnIInjnjjnjnjjjjnjjnjjjjnjjIl:vAowVFgjQiUkEwtSXqhwDKopH0njnII6
TLSH
T167937D23BC9149B9C491127615746A7E566FBC050BEAD6C38FDCDC0E222A6E4ED3E343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

blihanstealer discovery persistence stealer trojan

Static task

static1

2 signatures

trojan stealer blihanstealer

Behavioral task

behavioral1

Sample

ef8faf234ea6bca8b36538f75139651a7440533175d80c0489b2dfe3d0f4ca0b.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

150 seconds

discovery blihanstealer persistence stealer trojan

Malware Config

Extracted

Family

blihanstealer

Mutex

pomdfghrt

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Targets

- Target
  ef8faf234ea6bca8b36538f75139651a7440533175d80c0489b2dfe3d0f4ca0b
- Size 92KB
- SHA256 ef8faf234ea6bca8b36538f75139651a7440533175d80c0489b2dfe3d0f4ca0b
- MD5 0d4117f77f6ddfa38198865b53c1aa1d
- SHA1 2fcee8e96319b9613eb5fa982100b8a5b64d7dba
- SHA512 63a1ae1b210c0f07d78dc9e144592ae28ffa946d82e6363887f11f7537d799f58b0c8ef3c401babd50615d71b1825ad8fa930cad477ed2127ac13e1b5c3c4ec1
- SSDEEP 1536:vAowfbJFgjQ284U+w2EwRzSIUqhwDKopH0njnIInjnjjnjnjjjjnjjnjjjjnjjIl:vAowVFgjQiUkEwtSXqhwDKopH0njnII6
- TLSH
  T167937D23BC9149B9C491127615746A7E566FBC050BEAD6C38FDCDC0E222A6E4ED3E343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery blihanstealer persistence stealer trojan
- Family: BlihanStealer
  Blihan is a stealer written in C++.
  trojan stealer blihanstealer
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

trojanstealerblihanstealer

behavioral1

discoveryblihanstealerpersistencestealertrojan

© 2018-2026

Terms | Privacy