General

  • Target

    Soft.exe

  • Size

    971KB

  • Sample

    220306-pl7ggsaeb7

  • MD5

    4bfb3eec2adb1a05de60124765091e89

  • SHA1

    d2b8aa082f30309456a712784e04ef8165edd79f

  • SHA256

    9b459a76b2983ee1bc0b796e80d70f7bd564d04e9556e16256ba92d53425bf9c

  • SHA512

    6ec82b0fe33a7ef57ca4d4a75e5f07893444fa7a78d5c1770d7d61882d8902ee2b12b55d2c177c7ea12d80227a3605b29bf5a677c456224df5b6b5852a0b3e15

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1822617155:AAF5DW4sJVsYGItkXWeX3elycmmu-6nOK8g/sendMessage?chat_id=457263385

Targets

    • Target

      Soft.exe

    • Size

      971KB

    • MD5

      4bfb3eec2adb1a05de60124765091e89

    • SHA1

      d2b8aa082f30309456a712784e04ef8165edd79f

    • SHA256

      9b459a76b2983ee1bc0b796e80d70f7bd564d04e9556e16256ba92d53425bf9c

    • SHA512

      6ec82b0fe33a7ef57ca4d4a75e5f07893444fa7a78d5c1770d7d61882d8902ee2b12b55d2c177c7ea12d80227a3605b29bf5a677c456224df5b6b5852a0b3e15

    • BlackGuard

      Infostealer first seen in Late 2021.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks