General

  • Target

    Soft.exe

  • Size

    971KB

  • Sample

    220306-plndlsccaj

  • MD5

    64f7ad73e1404e00eb49c853e0aeba2e

  • SHA1

    7017b0087ebc433d1c3900517e59335241e84698

  • SHA256

    877f6bcd0f2061c42367abe8ab4fd83e4f151783466f6791399c3f7133af07f9

  • SHA512

    d76a44aec2fa2c9cba79e86a9119262aeb1833bd50b60a20844035931b40af90deedd6aa7e8862d893f6585ed204da1cb47a3056db946863f00ccd88425d6d70

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904

Targets

    • Target

      Soft.exe

    • Size

      971KB

    • MD5

      64f7ad73e1404e00eb49c853e0aeba2e

    • SHA1

      7017b0087ebc433d1c3900517e59335241e84698

    • SHA256

      877f6bcd0f2061c42367abe8ab4fd83e4f151783466f6791399c3f7133af07f9

    • SHA512

      d76a44aec2fa2c9cba79e86a9119262aeb1833bd50b60a20844035931b40af90deedd6aa7e8862d893f6585ed204da1cb47a3056db946863f00ccd88425d6d70

    • BlackGuard

      Infostealer first seen in Late 2021.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks