Extracted

• • Target

    05c2991a5ea29caa99dbf224aaf1cd4b5d3d88430118c6fd4d18d73130c54433

  • Size

    7.6MB

  • MD5

    4ecc21c7a2aadaf74dfac9e52723d41e

  • SHA1

    1e39e52aefb0b5c7fa16aaf9c9d870150482a4eb

  • SHA256

    05c2991a5ea29caa99dbf224aaf1cd4b5d3d88430118c6fd4d18d73130c54433

  • SHA512

    9273eed9eaea2638bfb310fa5ed84a0586512b7b85396fb5658e2eb06b7ab81b63cf615674cc4e32130d16a3e173e97b213b8423a5c0c025c36c04d274e85265

  • SSDEEP

    196608:Z0Xi4ZgUmPjE+Agbk9fcGVN8iNISGK71:yXiMgbj7AsGXiw

  Score

  10^/10

  blackguardcollectionevasionpersistencespywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets DLL path for service in the registry

    persistence

  • Sets file execution options in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2