Extracted

• • Target

    1b98a1d62cb0348ca334d047f4167f8bacd8de51829284a9be50e72d010e1cb8.exe

  • Size

    7.8MB

  • MD5

    7b83ec8b52b0960227678156e29c1104

  • SHA1

    f900ddff272431c281b76132fb110cb4120f68a3

  • SHA256

    1b98a1d62cb0348ca334d047f4167f8bacd8de51829284a9be50e72d010e1cb8

  • SHA512

    f79e951e71747b80d7dea383e4b44fcd4d1064b1d3a8ab93a5e9b9274cc9c88e8ece9856f630d9725991e886cb5df245d11f51ebbba26328e6589e293e0665d6

  • SSDEEP

    98304:Cgl47z3Aldea5a/OhtJeq+4NK+dG7M0mWZsE6+YhU+dbkh4yiMP0K:4/wld79ht+j1M0mWZsE6+YASy10K

  Score

  10^/10

  blackguarddiscoveryspywarestealer

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard

  • Blackguard family

    blackguard

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2