blackguard

General

Target

SimHub.9.02.12.zip
Size

181.5MB
Sample

240427-ylf4zaff2w
MD5

fbf6702c418835b83dca39db13128331
SHA1

c94b33dbe94a5786d8a9a372933f8d11995f87f4
SHA256

3b5e74774cd364e1843eb858181f1d3b657c562f3a8081b972997f33e36a869d
SHA512

61df577065d268548fd1a29fe64327bab834e5e130a30a9bb7f6dafca0e1c2c768dc6be96ec8c8f741bd2a087a94ce13cf11204dbbef6ec59c1b745720987043
SSDEEP

3145728:XmvXocgE2CyznSYaK5LYed67qcJdtW9iQYjlPZpGrikeBdy0hrKGtWu0Om1Gjiks:XmvXocgE2CESYaK53cJ69gjEekei0hrS

Score

10^/10

Malware Config

Targets

- Target
  
  SimHubSetup_9.2.12.exe
- Size
  
  182.1MB
- MD5
  
  86c3226649a51d84f04677b2b989a12d
- SHA1
  
  4d792241b15bbac7471a866a5259122f519a29f1
- SHA256
  
  ed7488ee51854444834ce8294bc592ca9befe8c4c913fc8a1ebf84b32dd99c41
- SHA512
  
  d3988010d869c161764c060c2c226140ee09f93446cc93ff06731d1d044c6cd64c29195f24d8e6caa831175448b31df269704a81bedc47e34beb64b78ad4c87d
- SSDEEP
  
  3145728:9+ldCIFc7coM5LwUvdnyY2vkatUIDPCNyyETPNlzs38Y6pLw9v3wHfwALVcJTTTS:9+ldCIFicoqcUvdnCUIGNmTsMY6K9v3q
Score

10^/10

blackguard ploutus atm backdoor discovery evasion persistence stealer
- BlackGuard
  Infostealer first seen in Late 2021.
  stealer blackguard
- Detected Ploutus loader
- Ploutus
  Ploutus is an ATM malware written in C#.
  backdoor atm ploutus
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2