General

  • Target

    Soft.exe

  • Size

    971KB

  • Sample

    220306-pk2vlscbhr

  • MD5

    7e9556a873f120b93aced165179f98a7

  • SHA1

    b695e29ac63fd6cc3f21c99f0475934abc6c26c8

  • SHA256

    bac6c21248d28323222b888c176062e52ec0f486c7238e9d68ac60cb31e24207

  • SHA512

    f580db12fc266791c5f4f35196114549497f5f9f0c2a7b84ad1dfd8b5a77c54e9f8e9ba26d36ca4dd323fdedb0495ce3dda3860de5c46d7d14f1f69ecea06ff8

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904

Targets

    • Target

      Soft.exe

    • Size

      971KB

    • MD5

      7e9556a873f120b93aced165179f98a7

    • SHA1

      b695e29ac63fd6cc3f21c99f0475934abc6c26c8

    • SHA256

      bac6c21248d28323222b888c176062e52ec0f486c7238e9d68ac60cb31e24207

    • SHA512

      f580db12fc266791c5f4f35196114549497f5f9f0c2a7b84ad1dfd8b5a77c54e9f8e9ba26d36ca4dd323fdedb0495ce3dda3860de5c46d7d14f1f69ecea06ff8

    • BlackGuard

      Infostealer first seen in Late 2021.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks