Extracted

• • Target

    aimstar.exe

  • Size

    7.7MB

  • MD5

    d7ec7f52738bcacf33d89fb8f1b84e19

  • SHA1

    ffed31ec21b973ce896ff03020c972d1fdb18982

  • SHA256

    636e70909dfc21703747ce167243327f31be31210107bfd865ad37a7b90e4720

  • SHA512

    1128f33463d97e0218fb61c77891d07597d49df28cd322dcf5ac0e4af1be4e40d9e469ac02a98a1790eda433a6d250875e471d63c1040f8bc7cd021f4a4db370

  • SSDEEP

    196608:Hi2odc8ACwKlRZFm2avkB0+lsFKKm5Ui+Luw/forAD:HBodbhjbaPcsFZNwAD

  Score

  10^/10

  blackguardspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2