Extracted

• • Target

    JPoint_exe..Scr

  • Size

    29.1MB

  • MD5

    3a642521a98b0fbd81443aa9c11f17c3

  • SHA1

    a124b3dd773c39af691a616ad36dc4df14c64dfc

  • SHA256

    5eecb69d92705c3bf225df3f4adc7965bd73b1c60f49bdf345cf1657a1dba84d

  • SHA512

    6c863f1c81c08573b4950fbfa210a49106d7d503a808de8e45f72cb12b326fe84c11124c83d6db59edbf164eb855fa0723d4cbd43f03d6f5a3d80b77d604a964

  • SSDEEP

    393216:TCUjvuM6PCZZIPGRVW2GHm3pVO/Gz/goYI4qq0EyEv1B35t1is3z1fr+4fLnjUme:TCJq4uPYHWVO9oyV3n1bz1z+WHFcg

  Score

  10^/10

  blackguardspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1