Static task
static1
Behavioral task
behavioral1
Sample
c98e24c174130bba4836e08d24170866aa7128d62d3e2b25f3bc8562fdc74a66.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
c98e24c174130bba4836e08d24170866aa7128d62d3e2b25f3bc8562fdc74a66.exe
Resource
win10v2004-20220331-en
General
-
Target
c98e24c174130bba4836e08d24170866aa7128d62d3e2b25f3bc8562fdc74a66
-
Size
4.2MB
-
MD5
bbb9de0f35d59374d7267f983a3f362b
-
SHA1
0c4df9e1941b1f555b867b016148409b51f49f63
-
SHA256
c98e24c174130bba4836e08d24170866aa7128d62d3e2b25f3bc8562fdc74a66
-
SHA512
4f0138f6bc8c2c015bc37b2a8178bf0fa043af90e6d1a487f7f739486e16d53d0d3ba86d8d30a060d93a038f63bc6cad23531bba90ff3c3aa7c9fc76f2858097
-
SSDEEP
49152:ghpEf4/4hyBYKMD+SNfXCwJtezvOd0HSC3souk1b36rH4cseBzjyxeb:ghpEwMD+SNfCWtwlcAxC
Malware Config
Extracted
blackguard
https://win.mirtonewbacker.com/
Signatures
-
Blackguard family
Files
-
c98e24c174130bba4836e08d24170866aa7128d62d3e2b25f3bc8562fdc74a66.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 171KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ