Overview

overview

10

Static

static

3

6f6f3c5cf6...0N.exe

windows7-x64

10

6f6f3c5cf6...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f6f3c5cf6e779cb7c503b94716e73e0N.exe

  • Size

    1.1MB

  • Sample

    240801-ngkw9asdpg

  • MD5

    6f6f3c5cf6e779cb7c503b94716e73e0

  • SHA1

    4593d3351517012bf4ffb71711b73e2db9482885

  • SHA256

    9f0e679e94ceaec68e0ea18348b4c80cb86a963f8371eec43c48dec3b2113597

  • SHA512

    eac8e16fc046f757ef30f198117507b5289750361408723a317d0e8e252334dae54b056238f1ff10abb7b017f8d19f57bd96a0ae344e4fd685a744b168bc03b4

  • SSDEEP

    24576:AuDXTIGaPhEYzUzA0IudFaqAmMtMM2dWks5NT:vDjlabwz9ddSD2ds

Score
10/10
blackguardcredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      6f6f3c5cf6e779cb7c503b94716e73e0N.exe

    • Size

      1.1MB

    • MD5

      6f6f3c5cf6e779cb7c503b94716e73e0

    • SHA1

      4593d3351517012bf4ffb71711b73e2db9482885

    • SHA256

      9f0e679e94ceaec68e0ea18348b4c80cb86a963f8371eec43c48dec3b2113597

    • SHA512

      eac8e16fc046f757ef30f198117507b5289750361408723a317d0e8e252334dae54b056238f1ff10abb7b017f8d19f57bd96a0ae344e4fd685a744b168bc03b4

    • SSDEEP

      24576:AuDXTIGaPhEYzUzA0IudFaqAmMtMM2dWks5NT:vDjlabwz9ddSD2ds

    Score
    10/10
    blackguardcredential_accessdiscoveryspywarestealer

    • BlackGuard

      Infostealer first seen in Late 2021.

      stealerblackguard

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks