General
- Target 2026-10-02_e563895dcc39d0f787de0f7c41e36fcc_elex_qilin
- Size 96KB
- Sample261002-3wytzsysax
- SHA256 40dedf06853f9f5b7c892249ff83a290eb73cbf0ced2adaab072670488d1ad9a
- MD5 e563895dcc39d0f787de0f7c41e36fcc
- SHA1 134ad68c1a03cb6220e861267f53afb6e7406e83
- SHA512 8a45d87586758ee44e6d84623f24dbbc28af618f29a827fa6319b01469e128d6a66eae20fec09452c11d4f1816e86de6880dc365623ef7e9e992872f4d9b7bee
- SSDEEP 3072:E1oEFlt6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKh2h7hWhB:E6t
- TLSH T185A3B34B4F71CDDBE800143E97AAA21C86D3FC541CCCF35A96EED84670C291C899E9A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-02_e563895dcc39d0f787de0f7c41e36fcc_elex_qilin.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_e563895dcc39d0f787de0f7c41e36fcc_elex_qilin.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Targets
-
- Target 2026-10-02_e563895dcc39d0f787de0f7c41e36fcc_elex_qilin
- Size 96KB
- SHA256 40dedf06853f9f5b7c892249ff83a290eb73cbf0ced2adaab072670488d1ad9a
- MD5 e563895dcc39d0f787de0f7c41e36fcc
- SHA1 134ad68c1a03cb6220e861267f53afb6e7406e83
- SHA512 8a45d87586758ee44e6d84623f24dbbc28af618f29a827fa6319b01469e128d6a66eae20fec09452c11d4f1816e86de6880dc365623ef7e9e992872f4d9b7bee
- SSDEEP 3072:E1oEFlt6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrh1hKh2h7hWhB:E6t
- TLSH T185A3B34B4F71CDDBE800143E97AAA21C86D3FC541CCCF35A96EED84670C291C899E9A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables built or packed with MPress PE compressor
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application