General
-
Target
https://cdn.discordapp.com/attachments/1325983421758967830/1326261789264056373/TotalAV_2.exe?ex=677ec90b&is=677d778b&hm=af409beccbb2288d7bedc41b398904c7dd054e7e82fe928f70ec7fbd486d3b83&
-
Sample
250107-xhqcssvrgp
Score
10/10
Malware Config
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1325983421758967830/1326261789264056373/TotalAV_2.exe?ex=677ec90b&is=677d778b&hm=af409beccbb2288d7bedc41b398904c7dd054e7e82fe928f70ec7fbd486d3b83&
Score10/10-
BlackGuard
Infostealer first seen in Late 2021.
-
Blackguard family
-
Creates new service(s)
-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-