General
-
Target
v2.exe
-
Size
271KB
-
Sample
250112-r99mvszjfq
-
MD5
3f62213d184b639a0a62bcb1e65370a8
-
SHA1
bbf50b3c683550684cdb345d348e98fbe2fcafe0
-
SHA256
c692dfc29e70a17cabc19561e8e2662e1fe32fdba998a09fe1a8dc2b7e045b34
-
SHA512
0cd40d714e6a6ebd60cc0c8b0e339905a5f1198a474a531b1794fb562f27053f118718cc68b9652fef3411906f9d8ad22d0253af256fa1922133e9907298e803
-
SSDEEP
6144:qmYKJMVRp9hnmy0UYU9B93YUnLbB62X3Rb36h3YQ:ZJ0Rp9hzL82ghIQ
Behavioral task
behavioral1
Sample
v2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
v2.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
blackguard
https://api.telegram.org/bot6540906397:AAG08fPgT-V7I17vtz49STaZEuwqXqKshuM/sendMessage?chat_id=5445185021
Targets
-
-
Target
v2.exe
-
Size
271KB
-
MD5
3f62213d184b639a0a62bcb1e65370a8
-
SHA1
bbf50b3c683550684cdb345d348e98fbe2fcafe0
-
SHA256
c692dfc29e70a17cabc19561e8e2662e1fe32fdba998a09fe1a8dc2b7e045b34
-
SHA512
0cd40d714e6a6ebd60cc0c8b0e339905a5f1198a474a531b1794fb562f27053f118718cc68b9652fef3411906f9d8ad22d0253af256fa1922133e9907298e803
-
SSDEEP
6144:qmYKJMVRp9hnmy0UYU9B93YUnLbB62X3Rb36h3YQ:ZJ0Rp9hzL82ghIQ
Score10/10-
Blackguard family
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2