Extracted

• • Target

    file_fdp..Scr

  • Size

    4.4MB

  • MD5

    4bc83684b8e2a9050d44374b2fc1e45d

  • SHA1

    00d390f567516249c0487d2eabd826dafa7a7b50

  • SHA256

    81603495e06315bfb9fc1b8dadbeccad47524ac15084a9a3f25274f76fff7adf

  • SHA512

    d914ca67a6fa7ebf66bd64ad088b59a6299e19c38aa3560076b6b91aa481d644dee4b652c0d7580c0f3c8c698f41f28531a0d8d2d11552d3edb7b5a407ea3569

  • SSDEEP

    98304:gDQ3MPvsFGblKNIknSb7tFTGN5nxPVRaxxVoPHj3cs593:wwMPvs4gNDnyyZxPFHwM3

  Score

  10^/10

  blackguardspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1