Overview

overview

10

Static

static

10

3b2683c524...ff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b2683c524eb693470d9274b2ed3aa1212e165e0e9be183fd958637dc2535bff

  • Size

    396KB

  • Sample

    240617-t9ehtswcma

  • MD5

    5824b4f4212fa06200294e98832af322

  • SHA1

    90ca0a180cda104f30d194c533d36e5967f3d215

  • SHA256

    3b2683c524eb693470d9274b2ed3aa1212e165e0e9be183fd958637dc2535bff

  • SHA512

    848ba810284837a25ca01dfb6eeae6472b93d92fd52cb5a837ea424daec9861eb9a9350079a7cc96292213cbe4a78cd229ea30663eb86740495e4fc1c4ca753d

  • SSDEEP

    6144:XbODqpwPEuxGH6OrwX3pwzZwEq7EtE6eBpgw6Om92BUz7BJwaPEqrPlTu/0:XyPPDLOrwX3pwzZwxB7M2uvfwARi0

Score
10/10
blackguardsharpstealerdiscoveryspywarestealer

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot7193726463:AAG095A6WSJXZaz6TC_UOtknTxwVjioD5bg/sendMessage?chat_id=5706502880

Extracted

Family

sharpstealer

C2

https://api.telegram.org/bot7193726463:AAG095A6WSJXZaz6TC_UOtknTxwVjioD5bg/sendMessage?chat_id=5706502880

Attributes
  • max_exfil_filesize

    1.5e+06

  • proxy_port

    168.235.103.57:3128

  • vime_world

    false

aes.plain

Targets

    • Target

      3b2683c524eb693470d9274b2ed3aa1212e165e0e9be183fd958637dc2535bff

    • Size

      396KB

    • MD5

      5824b4f4212fa06200294e98832af322

    • SHA1

      90ca0a180cda104f30d194c533d36e5967f3d215

    • SHA256

      3b2683c524eb693470d9274b2ed3aa1212e165e0e9be183fd958637dc2535bff

    • SHA512

      848ba810284837a25ca01dfb6eeae6472b93d92fd52cb5a837ea424daec9861eb9a9350079a7cc96292213cbe4a78cd229ea30663eb86740495e4fc1c4ca753d

    • SSDEEP

      6144:XbODqpwPEuxGH6OrwX3pwzZwEq7EtE6eBpgw6Om92BUz7BJwaPEqrPlTu/0:XyPPDLOrwX3pwzZwxB7M2uvfwARi0

    Score
    10/10
    sharpstealerdiscoveryspywarestealer

    • Sharp Stealer

      Sharp Stealer is an infostealer first observed in 2024, based on Echelon and Umbral stealers.

      stealersharpstealer

    • Sharpstealer family

      sharpstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks