Extracted

• • Target

    Shellbag_analyzer_cleaner.exe

  • Size

    7.7MB

  • MD5

    3ae04f7a93e7b23687ce6f82063e17ff

  • SHA1

    f1944f467dfa8df6423fb5ac329df21b3cf24b21

  • SHA256

    0db0408a30ff4c9548c015c6b6181a709130d4854288120a9cba5e9b14be52f0

  • SHA512

    f846885d4f0f3ff46510e58f6a1dafbcf29821c35ddb33980a6665ac65eb125f2687a53f80981d0a42c60b63de1d497253f85b887c67ea160f80e7f66576b70a

  • SSDEEP

    196608:bsKo8WI1AnTcKsYRK47UoZVIdYtXuo3rsEo2vJM980U:bsKo8WI8TcyzxN3rPG9G

  Score

  10^/10

  blackguardspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2