blackguard | 339a5d73c9d79aa4453c61bb915a895bf8495c562937f19f22136caa61f8fd3f

Sharing

Copy URL Twitter E-mail

General

Target
339a5d73c9d79aa4453c61bb915a895bf8495c562937f19f22136caa61f8fd3f
Size 35.2MB
Sample240616-bzfc9stfpe
SHA256 339a5d73c9d79aa4453c61bb915a895bf8495c562937f19f22136caa61f8fd3f
MD5 9a67ac2d8113e86a3699f49c485d345a
SHA1 59f7ae082bd9893286f549bd6dac033ffcf014b1
SHA512 c5e667019dfac64838fd660b396d3c2b1806922f449ffcddfd2e5e3dbdd0c1759d6fcfb14834faecbc45ad895685f20afe6bf2a41adf18715be46ee8a8a0dd1d
SSDEEP 393216:4RVXO3hEg5/JudPsRwyCpcyCpY1hhD2l3qcTKLbrGh3k6aBeA0K:KJshfBudPV3c3gkqcTKLbrGhZVA5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackguard

Malware Config

Signatures

Blackguard family
blackguard

File Explorer

339a5d73c9d79aa4453c61bb915a895bf8495c562937f19f22136caa61f8fd3f

.exe 35.2MB

339a5d73c9d79aa4453c61bb915a895bf8495c562937f19f22136caa61f8fd3f

IMPHASH bf1462ce2cfa173883d7ac57d7af7b93
SHA256 339a5d73c9d79aa4453c61bb915a895bf8495c562937f19f22136caa61f8fd3f
MD5 9a67ac2d8113e86a3699f49c485d345a
SHA1 59f7ae082bd9893286f549bd6dac033ffcf014b1
SHA512 c5e667019dfac64838fd660b396d3c2b1806922f449ffcddfd2e5e3dbdd0c1759d6fcfb14834faecbc45ad895685f20afe6bf2a41adf18715be46ee8a8a0dd1d
SSDEEP 393216:4RVXO3hEg5/JudPsRwyCpcyCpY1hhD2l3qcTKLbrGh3k6aBeA0K:KJshfBudPV3c3gkqcTKLbrGhZVA5
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

84:5a:41:35:7e:9b:17:71:e0:d8:d4:d8:c3:af:93:bd:30:6f:05:26

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=496063,CN=MMSOFT Design Ltd.,O=MMSOFT Design Ltd.,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Chains

Oct 5, 2023

SERIALNUMBER=496063,CN=MMSOFT Design Ltd.,O=MMSOFT Design Ltd.,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=496063,CN=MMSOFT Design Ltd.,O=MMSOFT Design Ltd.,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

SERIALNUMBER=496063,CN=MMSOFT Design Ltd.,O=MMSOFT Design Ltd.,L=Dublin,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Serial Number

07:be:62:85:48:77:49:82:c6:38:77:f8:db:1b:fb:c5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 17, 2022 - Aug 20, 2025

Minor OS version

Major OS version

Entry point

71312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary RtlUnwind RaiseException OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

terminate _controlfp_s _register_thread_local_exe_atexit_callback _errno _c_exit __p___wargv _seh_filter_exe __p___argc _configure_wide_argv _cexit _crt_atexit _exit exit _register_onexit_function _initialize_onexit_table _set_app_type _initterm_e _initterm _get_initial_wide_environment _invalid_parameter_noinfo_noreturn _initialize_wide_environment abort

api-ms-win-crt-heap-l1-1-0

calloc free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s __p__commode fflush _wfopen __stdio_common_vfwprintf fputws fclose fread fseek fwrite __acrt_iob_func fputwc __stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

strcpy_s memset strcspn wcsncmp _wcsicmp _wcsnicmp wcsnlen _wcsdup

api-ms-win-crt-locale-l1-1-0

__pctype_func setlocale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func localeconv _unlock_locales _lock_locales _configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

_time64 wcsftime _gmtime64

Sharing

General

Malware Config

Signatures

File Explorer

339a5d73c9d79aa4453c61bb915a895bf8495c562937f19f22136caa61f8fd3f

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

generic