Extracted

• • Target

    Nexus.rar

  • Size

    43.8MB

  • MD5

    df63bf9b18c54a64fb6c118bfe1e223f

  • SHA1

    ab5b0df26fcbe1e356bc762870cd257ff4c560c3

  • SHA256

    39c4efb2b75efd4bf6903e18c614787057ceaac2a81fe0d1f397610171b18df7

  • SHA512

    6fd38aacaf3c0cb893cc4ac8d163bb65181c68820fd0b6d9f22d25f05743fea19d4bc89b717f1d4303e500283d88eb0e8be0247eaae8390d6035a565bb708bb9

  • SSDEEP

    786432:M1qJCbq2jOslN4s/yxiLsaX2OmIzJxzrJoVAcu+sA/mkK2G1B:M1BuFEN/ysLsgWIrBcCuLG1B

  Score

  10^/10

  blackguardpyinstallerspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1