Behavioral task
behavioral1
Sample
18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe
Resource
win10v2004-20230220-en
General
-
Target
08c1b360ad5f727a0660adfa74bd7509.bin
-
Size
98KB
-
MD5
d12a91616999e1b473893b2dc36ed1af
-
SHA1
23d89f07f37bbc54f57c5797ccd70a7aa05a84d4
-
SHA256
cbf36c0b3ee45c39dc04c9faa807dfb819dc049e60b6b5282d2ea4cc0a8c717f
-
SHA512
10079adc4cbc1a1fe8580a6af3abd029f47d78776851a15b313df027a0fb53833f63fde0f33aaabf739f5e87fd2e47d4b7e916064206267e3c960d3012ab6065
-
SSDEEP
3072:RNZIsY2JmJXhaVLgSM4uYVHxk7MrX+63Sp:jZIs/JmRhaebMyYrX+p
Malware Config
Extracted
blackguard
https://api.telegram.org/bot5973155151:AAGgQ2GQ_WZVdt1bf_ib5JEZozBNQ7N52ww/sendMessage?chat_id=1870895902
Signatures
-
Blackguard family
Files
-
08c1b360ad5f727a0660adfa74bd7509.bin.zip
Password: infected
-
18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 235KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ