General
-
Target
Soft.exe
-
Size
971KB
-
Sample
220306-plndlsccaj
-
MD5
64f7ad73e1404e00eb49c853e0aeba2e
-
SHA1
7017b0087ebc433d1c3900517e59335241e84698
-
SHA256
877f6bcd0f2061c42367abe8ab4fd83e4f151783466f6791399c3f7133af07f9
-
SHA512
d76a44aec2fa2c9cba79e86a9119262aeb1833bd50b60a20844035931b40af90deedd6aa7e8862d893f6585ed204da1cb47a3056db946863f00ccd88425d6d70
Static task
static1
Behavioral task
behavioral1
Sample
Soft.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
Soft.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
blackguard
https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904
Targets
-
-
Target
Soft.exe
-
Size
971KB
-
MD5
64f7ad73e1404e00eb49c853e0aeba2e
-
SHA1
7017b0087ebc433d1c3900517e59335241e84698
-
SHA256
877f6bcd0f2061c42367abe8ab4fd83e4f151783466f6791399c3f7133af07f9
-
SHA512
d76a44aec2fa2c9cba79e86a9119262aeb1833bd50b60a20844035931b40af90deedd6aa7e8862d893f6585ed204da1cb47a3056db946863f00ccd88425d6d70
Score10/10-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-