MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlakcSeeStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5
SHA3-384 hash: 926444d45ebd513442ba6634d3f7b075153d3ba177a287b096e1ba3ce6d75039cc4f1e6c3a9c0a0db1e654d557ad29f1
SHA1 hash: f6662cc6c68106317bec4c4e9a868cd575d16249
MD5 hash: 8a3eea9f1ba7f1b64966d71d6c50fa84
humanhash: fish-pasta-angel-mobile
File name:vsdbg.dll
Download: download sample
Signature BlakcSeeStealer
Create hunting rule
File size:2'880'000 bytes
First seen:2026-07-23 07:11:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 22db4279351881cc876b9d7a5b04df90 (1 x Vidar, 1 x BlakcSeeStealer)
ssdeep 49152:9sc0n4qLPTkqVAPDMqAp/sP7zZvz7csf6tqidS1E6Fp:A/6vJvv76tdG
TLSH T186D5D015E39901B8E567EB78CB569233DAB1B8460331E68F0689D7162F33ED09B7B311
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter aachum
Tags:37-77-150-162 BlakcSeeStealer dll


Avatar
iamaachum
https://metricobject.com/download-archive

BlakcSeeStealer C2: http://37.77.150.162:5051/upload

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75760/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.45713864.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug crypto dropper masquerade microsoft_visual_cc packed reconnaissance stealer
Link:
https://www.filescan.io/uploads/6a61bee2b818192c91404380/reports/d5e046d3-01b0-4b21-9b6e-34504c082843/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5
Verdict:
Malicious
File Type:
dll x64
First seen:
2026-07-20T14:45:00Z UTC
Last seen:
2026-07-23T17:14:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ad62be9a-4c91-4439-9a6c-4e37db640d64
Result
Threat name:
BlakcSee Stealer
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1946981
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Modifies existing user documents (likely ransomware behavior)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected BlakcSee Stealer
Yara detected Generic Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1946981 Sample: vsdbg.dll.exe Startdate: 23/07/2026 Architecture: WINDOWS Score: 100 57 ip-api.com 2->57 59 api.ipify.org 2->59 67 Suricata IDS alerts for network traffic 2->67 69 Found malware configuration 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 4 other signatures 2->73 10 loaddll64.exe 1 2->10         started        signatures3 process4 process5 12 rundll32.exe 10->12         started        15 cmd.exe 1 10->15         started        17 rundll32.exe 10->17         started        19 31 other processes 10->19 signatures6 105 Writes to foreign memory regions 12->105 107 Allocates memory in foreign processes 12->107 109 Modifies the context of a thread in another process (thread injection) 12->109 21 ServiceModelReg.exe 73 12->21         started        25 rundll32.exe 15->25         started        111 Injects a PE file into a foreign processes 17->111 27 ServiceModelReg.exe 17->27         started        30 ServiceModelReg.exe 19->30         started        process7 dnsIp8 63 ip-api.com 208.95.112.1, 49713, 49714, 49717 TUT-AS-TotalUptimeTechnologiesLLCUS United States 21->63 65 api.ipify.org 104.26.12.205, 443, 49711, 49712 CLOUDFLARENET-CloudflareIncUS Canada 21->65 75 Contains functionality to inject threads in other processes 21->75 77 Contains functionality to inject code into remote processes 21->77 79 Creates a thread in another existing process (thread injection) 21->79 95 2 other signatures 21->95 32 chrome.exe 21->32         started        34 chrome.exe 21->34         started        81 Found many strings related to Crypto-Wallets (likely being stolen) 25->81 83 Writes to foreign memory regions 25->83 85 Allocates memory in foreign processes 25->85 87 Modifies the context of a thread in another process (thread injection) 25->87 36 ServiceModelReg.exe 238 25->36         started        53 C:\Users\user\AppData\...\PSAMNLJHZW.xlsx, PSA 27->53 dropped 55 C:\Users\user\AppData\...\PSAMNLJHZW.docx, PSA 27->55 dropped 89 Injects a PE file into a foreign processes 27->89 91 Modifies existing user documents (likely ransomware behavior) 27->91 41 chrome.exe 27->41         started        43 chrome.exe 27->43         started        93 Tries to harvest and steal browser information (history, passwords, etc) 30->93 file9 signatures10 process11 dnsIp12 61 37.77.150.162, 49791, 49792, 49793 PROTON66RU Russia 36->61 49 C:\Users\user\AppData\...\QVTVNIBKSD.docx, ASCII 36->49 dropped 51 C:\Users\user\AppData\...\PSAMNLJHZW.xlsx, PSA 36->51 dropped 97 Writes to foreign memory regions 36->97 99 Allocates memory in foreign processes 36->99 101 Creates a thread in another existing process (thread injection) 36->101 103 2 other signatures 36->103 45 chrome.exe 36->45         started        47 chrome.exe 36->47         started        file13 signatures14 process15
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-20 18:52:00 UTC
File Type:
PE+ (Dll)
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5b6cr2sm3za4g37wafx5r5uc62enwl3swoxukus5pb5trjhwl3sq._file
Verdict:
malicious
Label(s):
BoryptGrab
Create hunting rule
Link:
https://reports.threatray.com/92e0ed4d-417e-499e-a959-260c07368405
Similar samples:
150bccbde3ba9db9347f5e41984ac9643f860ab423c62376cdafc031c2e8458e
BlakcSeeStealer
480bdd66621a0869dff575523f7e4ad5b7528744c1dc40f6f80bc85233433186
BlakcSeeStealer
6ec47a67ccca5c2254f8034bc6f7ddbdd299097de2028f637f24fbeb8879674f
BlakcSeeStealer
76d750e2ddfed6f984d95ab0419a085e21f124924c4ab64be5732a1d93719299
BlakcSeeStealer
e5dda4e7dc6b95830c066b519383e71abd4fb0a2340c0def898f635d9cfa13e7
BlakcSeeStealer
e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5
BlakcSeeStealer
Result
Malware family:
blakcsee_stealer
Create hunting rule
Score:
  10/10
Tags:
family:blakcsee_stealer discovery stealer
Link:
https://tria.ge/reports/260723-h1stbatbrc/
Behaviour
Checks processor information in registry
Suspicious use of WriteProcessMemory
Browser Information Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Family: BlakcSeeStealer
Malware Config
C2 Extraction:
37.77.150.162
Unpacked files
SH256 hash:
e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5
MD5 hash:
8a3eea9f1ba7f1b64966d71d6c50fa84
SHA1 hash:
f6662cc6c68106317bec4c4e9a868cd575d16249
Link:
https://www.unpac.me/results/d68bb18b-fcca-4755-91b7-93e1a02667a5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e87c28ea4cde/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BoryptGrab
Create hunting rule
Author:Still
Description:attempts to match strings/instructions found in BoryptGrab/BlakcSeeStealer core
Rule name:BunnyLoader
Create hunting rule
Author:indest
Description:generic crypto/card stealer rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BlakcSeeStealer

Executable exe e87c28ea4cde41c36ff6016fd8f682f688db2f72b3af45525d787b38a4f65ee5

(this sample)

  
Link
https://tria.ge/260723-hbtpbasfpg/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75760/

Comments