Extracted

• • Target
    presa/vsdbg.dll
  • Size 2.5MB
  • SHA256 d5a6f8a6e20fbb93b9eadbbda03e8143c47dfe1729b4271d7065dd0d9e2ffe73
  • MD5 2902eacc267b618b4c6d24891b8e71d4
  • SHA1 2bedfbe4b55bef4241071d2baac3e9d95deea144
  • SHA512 576cdf2386b8e63eb0733529e031e1af209e53c6f2c581f919f974029fc3f6320c7c7d2425fcad12817e198e679f6d6e24d378dcabcaf8a2abd5ace8318ee742
  • SSDEEP 49152:SgjVcvGf2egLHix2Yjd099dVt1LIPDHmj0cg3CbBSZ+V:siz2Yo9pmbGjc3a
  • TLSH
    T179C5DF15E3D811A4D97BD734CA61A332DAB078565732E2CB0A89D7452F33AE19B3F312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryblakcsee_stealerstealer

  • Family: BlakcSeeStealer

    BlakcSeeStealer is a Windows stealer written in C++.

    stealerblakcsee_stealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    presa/vsdbg.exe
  • Size 22KB
  • SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
  • MD5 41ad4cb04af8def70763d895973584e2
  • SHA1 24fd6c86360d98e565bc7f3a6aa8165bc34c325f
  • SHA512 db3e871cc646eeab7eb2bbeceb323f0951199ea698f91eaa5eec367e48b461748c472867383560c22bce5cba1d4f09fb25983a92f219c867e8fd40d0c53bb43e
  • SSDEEP 384:gMoZapK5vwxSYjWAlaWFOSxE1+aHRN7t0jHvDyR9zv:gnZaBgyEN+2t0rD+9z
  • TLSH
    T1FFA27C9ADA78058BF8EA18B08279E98BBC3DB7D31B5092CB0354E6181D137C5FA3475D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryblakcsee_stealerstealer

  • Family: BlakcSeeStealer

    BlakcSeeStealer is a Windows stealer written in C++.

    stealerblakcsee_stealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral3
• • Target
    presa/vsdebugeng.dll
  • Size 3.6MB
  • SHA256 076b2a9dd101f99e031a641150da8d12b03591d85a234dfe339a344026c2e587
  • MD5 98e9aee8efbff4830c044712cf4fc885
  • SHA1 a787b13b5629032e7f888d8013508d5a0d8ab7e1
  • SHA512 bea86d4a87a518963b51e6ed4c31b65e823be57c2e1b87f72ffd29360e18e47659d4ef7df5fa6a4477029455f8c537484f0f2e3beb00b3df2c21a8d98871a0b6
  • SSDEEP 49152:+UMZg766BnzEXC+ShVI8g6XOWhnPUJ1j2gE/:+sEChrZhn
  • TLSH
    T1E4061942B656D0A5D07AF2788DDB9729FAB1B815CB2246C7B4E0472E7E673C0573B20C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4
• • Target
    presa/webservices.dll
  • Size 1.4MB
  • SHA256 8ec55086fbef306b38cf53be62166c70dc20ee3c46c6ef1afdbfb76805da2814
  • MD5 6a97102fb451ef9cb7f8e415eddbcb14
  • SHA1 2a70d43a64405a9f472a5a04e22344d117f11066
  • SHA512 ecbe68289c76146c493fcfee628bdd3b0bf5c2ef5c1ebffba9eeba0a180c3bdca2c648b8abf61bb9e17f8760710e5f44b3b23345ca4bba9fb0ab4e2548b7a696
  • SSDEEP 24576:mtlXI1EeOvW1JpHvaKLZ3gfqjldnKYTXo9eEAMyKVN:UX4EeOvW1JpyKLZQyjldnK6XocEYC
  • TLSH
    T1B8657C1AA6A800E5C7FFD238C657862FDBF13425536057CF06648A796F23BE4963E318
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5