General

  • Target

    v2.exe

  • Size

    271KB

  • Sample

    250112-slyq5aznbr

  • MD5

    3f62213d184b639a0a62bcb1e65370a8

  • SHA1

    bbf50b3c683550684cdb345d348e98fbe2fcafe0

  • SHA256

    c692dfc29e70a17cabc19561e8e2662e1fe32fdba998a09fe1a8dc2b7e045b34

  • SHA512

    0cd40d714e6a6ebd60cc0c8b0e339905a5f1198a474a531b1794fb562f27053f118718cc68b9652fef3411906f9d8ad22d0253af256fa1922133e9907298e803

  • SSDEEP

    6144:qmYKJMVRp9hnmy0UYU9B93YUnLbB62X3Rb36h3YQ:ZJ0Rp9hzL82ghIQ

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot6540906397:AAG08fPgT-V7I17vtz49STaZEuwqXqKshuM/sendMessage?chat_id=5445185021

Targets

    • Target

      v2.exe

    • Size

      271KB

    • MD5

      3f62213d184b639a0a62bcb1e65370a8

    • SHA1

      bbf50b3c683550684cdb345d348e98fbe2fcafe0

    • SHA256

      c692dfc29e70a17cabc19561e8e2662e1fe32fdba998a09fe1a8dc2b7e045b34

    • SHA512

      0cd40d714e6a6ebd60cc0c8b0e339905a5f1198a474a531b1794fb562f27053f118718cc68b9652fef3411906f9d8ad22d0253af256fa1922133e9907298e803

    • SSDEEP

      6144:qmYKJMVRp9hnmy0UYU9B93YUnLbB62X3Rb36h3YQ:ZJ0Rp9hzL82ghIQ

    • BlackGuard

      Infostealer first seen in Late 2021.

    • Blackguard family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks