Static task
static1
Behavioral task
behavioral1
Sample
f2d25cb96d3411e4696f8f5401cb8f1af0d83bf3c6b69f511f1a694b1a86b74d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f2d25cb96d3411e4696f8f5401cb8f1af0d83bf3c6b69f511f1a694b1a86b74d.exe
Resource
win10v2004-20220414-en
General
-
Target
7681506159.zip
-
Size
1.7MB
-
MD5
cfe8f908a47b49bbf5d173d3f9e1cc3b
-
SHA1
3c84bef349e209417218145c29198d394d61a58a
-
SHA256
45d3aaddefc1dff057687f38bbe8124e48a98e5dd053f6f62496f3dc3b48eef0
-
SHA512
864ccb984779948ffee2a07c85f77f88f8d63260631ecc489e4dfbc727f195d7e5991db542c9adbf1f15e880284e92276db9f4a00891892f50ce195929437d18
-
SSDEEP
49152:4XactrHcdZQxJSWfqZ78SGq5SqNjfT6kmbA:OUZjuq6VmTwE
Malware Config
Extracted
blackguard
https://onetwostep.at/
Signatures
-
Blackguard family
Files
-
7681506159.zip.zip
Password: infected
-
f2d25cb96d3411e4696f8f5401cb8f1af0d83bf3c6b69f511f1a694b1a86b74d.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ