Extracted

• • Target

    cleaner.exe

  • Size

    2.6MB

  • MD5

    38892c681fbfba55e79f825cad8b0674

  • SHA1

    ee1e86add82844c30c003899ea819d5edcd07df3

  • SHA256

    76b90299713b5d4ffd3c92b2cd66b3de68148c3133f927dfa385b075fd00d5b1

  • SHA512

    4f013a16318f6b16cc1b1c38e0911d073752e1081a7f8f799cf2b192282d408a1a423eb8b11438685221e988b3c8e3f9be3d2e13b1e3d424a051691dbbe70b1c

  Score

  10^/10

  blackguardspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2