Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10BlackGuard...er.exe
windows7-x64
10BlackGuard...er.exe
windows10-2004-x64
10BlackGuard...ib.dll
windows7-x64
1BlackGuard...ib.dll
windows10-2004-x64
1BlackGuard...op.dll
windows7-x64
3BlackGuard...op.dll
windows10-2004-x64
8BlackGuard...op.dll
windows7-x64
1BlackGuard...op.dll
windows10-2004-x64
8BlackGuard...lib.js
windows7-x64
3BlackGuard...lib.js
windows10-2004-x64
8BlackGuard...x.html
windows7-x64
3BlackGuard...x.html
windows10-2004-x64
3BlackGuard...unc.js
windows7-x64
3BlackGuard...unc.js
windows10-2004-x64
8BlackGuard...ter.js
windows7-x64
3BlackGuard...ter.js
windows10-2004-x64
8BlackGuard...d.html
windows7-x64
3BlackGuard...d.html
windows10-2004-x64
8Analysis
-
max time kernel
123s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
07/02/2025, 22:15
Behavioral task
behavioral1
Sample
BlackGuard Stealer Builder/Builder/Builder.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BlackGuard Stealer Builder/Builder/Builder.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral3
Sample
BlackGuard Stealer Builder/Builder/dnlib.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
BlackGuard Stealer Builder/Builder/dnlib.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
BlackGuard Stealer Builder/Panel/www/32/SQLite.Interop.dll
Resource
win7-20250207-en
Behavioral task
behavioral6
Sample
BlackGuard Stealer Builder/Panel/www/32/SQLite.Interop.dll
Resource
win10v2004-20250207-en
Behavioral task
behavioral7
Sample
BlackGuard Stealer Builder/Panel/www/64/SQLite.Interop.dll
Resource
win7-20250207-en
Behavioral task
behavioral8
Sample
BlackGuard Stealer Builder/Panel/www/64/SQLite.Interop.dll
Resource
win10v2004-20250207-en
Behavioral task
behavioral9
Sample
BlackGuard Stealer Builder/Panel/www/files/pclzip.lib.js
Resource
win7-20250207-en
Behavioral task
behavioral10
Sample
BlackGuard Stealer Builder/Panel/www/files/pclzip.lib.js
Resource
win10v2004-20250207-en
Behavioral task
behavioral11
Sample
BlackGuard Stealer Builder/Panel/www/index.html
Resource
win7-20250207-en
Behavioral task
behavioral12
Sample
BlackGuard Stealer Builder/Panel/www/index.html
Resource
win10v2004-20250207-en
Behavioral task
behavioral13
Sample
BlackGuard Stealer Builder/Panel/www/panel/js/func.js
Resource
win7-20250207-en
Behavioral task
behavioral14
Sample
BlackGuard Stealer Builder/Panel/www/panel/js/func.js
Resource
win10v2004-20250207-en
Behavioral task
behavioral15
Sample
BlackGuard Stealer Builder/Panel/www/panel/pages/footer.js
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
BlackGuard Stealer Builder/Panel/www/panel/pages/footer.js
Resource
win10v2004-20250207-en
Behavioral task
behavioral17
Sample
BlackGuard Stealer Builder/Panel/www/panel/pages/head.html
Resource
win7-20250207-en
Behavioral task
behavioral18
Sample
BlackGuard Stealer Builder/Panel/www/panel/pages/head.html
Resource
win10v2004-20250207-en
General
-
Target
BlackGuard Stealer Builder/Panel/www/64/SQLite.Interop.dll
-
Size
1.6MB
-
MD5
616827a61d7a49ce5389c5d96443e35d
-
SHA1
d522ee5607e122e775d77641dba09711146db739
-
SHA256
54d4025bc175de5367d0ace1a78fec7edf06b642892691cf85afb02b8ab166d5
-
SHA512
fd6a53cb9851e56b8dc6a40627058852f2949688b73dacf6f3e0fcf932453b8c52a3bfefb12c80c38397a89f1038ad8fad329ea2798b86457ce5d8fe7ba87312
-
SSDEEP
24576:OFZGH4BNxe0T/3azYNf6M5q4Kf3ghEsSZCdhhs2s90LkZGOvZgSEd:OFZ1x6Y6MoX/g4sdbsf90L7
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 41 5036 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2344 MicrosoftEdgeUpdate.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\BlackGuard Stealer Builder\Panel\www\64\SQLite.Interop.dll",#11⤵PID:1916
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjJFOTk4MTQtNDZGNS00RTAzLUE4MTktNzhCNzk3NUU5MzUxfSIgdXNlcmlkPSJ7ODM1REJFRkQtOUUzMS00QzdDLUE0OTgtRjJCRjAwNzAyREIwfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NUQ1N0FBMUUtQ0I4Qi00RTg5LUFCOTgtMjU2QTg4RTlFNTI5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4MTUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE1MzQzMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzAxOTMwMzgzIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2344