Extracted

• • Target

    2f1db126393f9fac859569890bb05bf82a9ccc03a46e61d8eb0048d749948b80

  • Size

    1.2MB

  • MD5

    47c44d12d251014b6a8094b5537e9fe8

  • SHA1

    7183573e18f4cd5d88f098791782c4d174960618

  • SHA256

    2f1db126393f9fac859569890bb05bf82a9ccc03a46e61d8eb0048d749948b80

  • SHA512

    5c0e9473ba20f6f424bec839e7d1795f19ace8ce9a017c8ef051812873a9e9be903e1a1d524a95ad46c20ad8b14e9e4f748004114cd4311c01251d1782554792

  • SSDEEP

    24576:ZTXN0zCcPfOqygUl/Qs7exFQlWoC5Bi/r1+gqhKTEBhR86wdMCtMw4Im:VXGz/exZCxl5w/Rnqh/C6pCB

  Score

  10^/10

  blackguardstealerspyware

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2