Extracted

• • Target

    cleaner.exe

  • Size

    4.3MB

  • MD5

    ef8385f6ccc6dc6aa6fa9833e13c1cf3

  • SHA1

    2fe6c0b8cef78d409d29fbd0d1260f39874b068e

  • SHA256

    5b8d0e358948f885ad1e6fa854f637c1e30036bc217f2c7f2579a8782d472cda

  • SHA512

    2efe1baab3b815baf2f45acca6afc3e2692cb2fa7e4806515f4376a43ad17f474551dcee87c03f65fe99ca553c79140ba6d35193753800bbeb0e3c27f2a9bbeb

  Score

  10^/10

  blackguardspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2