blackguard | e0580491c1146ad6707ad2d81a080cb6fb545bd6b8e2dbc16e0b06e9780764eb | Triage

Resubmissions

12/03/2025, 21:37

250312-1gyvbsvrx7 10

12/03/2025, 21:23

250312-z8hrravpt3 10

Sharing

General

Target

MicrosoftActivator.exe
Size

130.1MB
Sample

250312-1gyvbsvrx7
MD5

57f71793f17ef4f6d1aad11db4b9e402
SHA1

488bbda45048d6dab83d3d725bd97c9b7f8e5987
SHA256

e0580491c1146ad6707ad2d81a080cb6fb545bd6b8e2dbc16e0b06e9780764eb
SHA512

3394f7ba35438b9bc7fad9466ec299851bb5a4a301c48c58eaabcc17e7fd7286257589157937d286359597344a6d9b3a4c26c96c1f89683a5059afd01efa6447
SSDEEP

786432:nkgh3akgh2vk49Otsbyx1DOUNoER7gHk49Otsbyx1DOUNoER7g2:kgJTgwvk49QsmPf2Hk49QsmPf22

Score

10^/10

blackguard discovery execution spyware stealer

Malware Config

Targets

- Target
  
  MicrosoftActivator.exe
- Size
  
  130.1MB
- MD5
  
  57f71793f17ef4f6d1aad11db4b9e402
- SHA1
  
  488bbda45048d6dab83d3d725bd97c9b7f8e5987
- SHA256
  
  e0580491c1146ad6707ad2d81a080cb6fb545bd6b8e2dbc16e0b06e9780764eb
- SHA512
  
  3394f7ba35438b9bc7fad9466ec299851bb5a4a301c48c58eaabcc17e7fd7286257589157937d286359597344a6d9b3a4c26c96c1f89683a5059afd01efa6447
- SSDEEP
  
  786432:nkgh3akgh2vk49Otsbyx1DOUNoER7gHk49Otsbyx1DOUNoER7g2:kgJTgwvk49QsmPf2Hk49QsmPf22
Score

8^/10

discovery execution spyware stealer
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecutionspywarestealer