blackguard

General

Target

364be73be12ad3e8d754ef00f5210ba22601cd5750387a44ea6cb3e2fe7b7ea7.exe
Size

22.3MB
Sample

221106-bh891saec2
MD5

8d448b08db9940dbb1e6104aafb764b5
SHA1

598055150c5ddb564be058a3ebfa5ad643dda286
SHA256

364be73be12ad3e8d754ef00f5210ba22601cd5750387a44ea6cb3e2fe7b7ea7
SHA512

2ff2f047845e49ab028e48fdd44430a664227bbfb0bc1468ecaef0823a492b4486f49e459fefd5c498eb3104ed597a35870ab82ea3787a56bfcaf07fa2d16696
SSDEEP

49152:wTIIOXvsGcGOxHf+fRCWca/+TtiuUHm5n9O8aXhb0:w0NXvhDUmfRCy+pUin98h

Score

10^/10

Malware Config

Targets

- Target
  
  364be73be12ad3e8d754ef00f5210ba22601cd5750387a44ea6cb3e2fe7b7ea7.exe
- Size
  
  22.3MB
- MD5
  
  8d448b08db9940dbb1e6104aafb764b5
- SHA1
  
  598055150c5ddb564be058a3ebfa5ad643dda286
- SHA256
  
  364be73be12ad3e8d754ef00f5210ba22601cd5750387a44ea6cb3e2fe7b7ea7
- SHA512
  
  2ff2f047845e49ab028e48fdd44430a664227bbfb0bc1468ecaef0823a492b4486f49e459fefd5c498eb3104ed597a35870ab82ea3787a56bfcaf07fa2d16696
- SSDEEP
  
  49152:wTIIOXvsGcGOxHf+fRCWca/+TtiuUHm5n9O8aXhb0:w0NXvhDUmfRCy+pUin98h
Score

10^/10

blackguard neshta persistence spyware stealer vmprotect
- BlackGuard
  Infostealer first seen in Late 2021.
  stealer blackguard
- Detect Neshta payload
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Downloads MZ/PE file
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2