Extracted

• • Target
    05c2991a5ea29caa99dbf224aaf1cd4b5d3d88430118c6fd4d18d73130c54433
  • Size 7.6MB
  • SHA256 05c2991a5ea29caa99dbf224aaf1cd4b5d3d88430118c6fd4d18d73130c54433
  • MD5 4ecc21c7a2aadaf74dfac9e52723d41e
  • SHA1 1e39e52aefb0b5c7fa16aaf9c9d870150482a4eb
  • SHA512 9273eed9eaea2638bfb310fa5ed84a0586512b7b85396fb5658e2eb06b7ab81b63cf615674cc4e32130d16a3e173e97b213b8423a5c0c025c36c04d274e85265
  • SSDEEP 196608:Z0Xi4ZgUmPjE+Agbk9fcGVN8iNISGK71:yXiMgbj7AsGXiw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  blackguardcollectionevasionpersistencespywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets DLL path for service in the registry

    persistence

  • Sets file execution options in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2