Static task
static1
Behavioral task
behavioral1
Sample
Soft.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Soft.exe
Resource
win10v2004-en-20220112
General
-
Target
Soft.exe
-
Size
971KB
-
MD5
4bfb3eec2adb1a05de60124765091e89
-
SHA1
d2b8aa082f30309456a712784e04ef8165edd79f
-
SHA256
9b459a76b2983ee1bc0b796e80d70f7bd564d04e9556e16256ba92d53425bf9c
-
SHA512
6ec82b0fe33a7ef57ca4d4a75e5f07893444fa7a78d5c1770d7d61882d8902ee2b12b55d2c177c7ea12d80227a3605b29bf5a677c456224df5b6b5852a0b3e15
Malware Config
Extracted
blackguard
https://api.telegram.org/bot1822617155:AAF5DW4sJVsYGItkXWeX3elycmmu-6nOK8g/sendMessage?chat_id=457263385
Signatures
-
Blackguard family
Files
-
Soft.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 808KB - Virtual size: 807KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ