blackguard | d244422e4bb038a8a0dd103c4ee6063c60da82933682bb5399e1fbfc4eb601ba

Sharing

Copy URL Twitter E-mail

General

Target
Vengrom executor.zip
Size 35.7MB
Sample260210-ytssqsa19a
SHA256 d244422e4bb038a8a0dd103c4ee6063c60da82933682bb5399e1fbfc4eb601ba
MD5 d428b4743cd66f73d474b1f7b8894443
SHA1 68f1b0eef4452515ed55d079beb7b8d547271b44
SHA512 d9a720cd3a190c04c4efd299838e200f9a8847e939fcb4be56d4ea1319e688d58bed15c6151e8e12aa5a65e2e90d0d9fb4d6219716e2178715645a49f3b54455
SSDEEP 786432:aZln+d3YguXD6znJxDWFEheiKRTMFjwQ8PXDlC:aZln+d3Y1X+zUEIiKqw9JC
TLSH
T10F8733F282722F91E00D36357D4D5BC3181BD8B57786D3A918A8292B98CDB9DF8114FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Vengrom executor.zip
- Size 35.7MB
- SHA256 d244422e4bb038a8a0dd103c4ee6063c60da82933682bb5399e1fbfc4eb601ba
- MD5 d428b4743cd66f73d474b1f7b8894443
- SHA1 68f1b0eef4452515ed55d079beb7b8d547271b44
- SHA512 d9a720cd3a190c04c4efd299838e200f9a8847e939fcb4be56d4ea1319e688d58bed15c6151e8e12aa5a65e2e90d0d9fb4d6219716e2178715645a49f3b54455
- SSDEEP 786432:aZln+d3YguXD6znJxDWFEheiKRTMFjwQ8PXDlC:aZln+d3Y1X+zUEIiKqw9JC
- TLSH
  T10F8733F282722F91E00D36357D4D5BC3181BD8B57786D3A918A8292B98CDB9DF8114FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  vengrom executor/Bin/Monaco Editor/README.md
- Size 280B
- SHA256 df9de7122fea34976c0a12ab67d2ec6e3a10e07b0857d54f31322e0ffb09f9d4
- MD5 bd64088c05f2535e5666fbcfb003eb59
- SHA1 53117188a9058d6ab93e02fbd198e73845811bd8
- SHA512 3683d787896da1fe286d8009fa8e04318982060b76bac597a9fb31717399869e51a2d092b689758b0837ef41841074e511446736bdf194d26a187ead06f3b599
- TLSH
  T16DD02B5BB0C923B10F211721550788E9FB65A1C193BC45383678B1DD3910E66D3A5156
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  vengrom executor/Bin/Monaco Editor/vs/base/worker/workerMain.js.map
- Size 561KB
- SHA256 dd4420cdd28139ad2232bb587aaf1dbc4173b2b4f8d212e5a003cdc055122ad8
- MD5 0477190fc50bc6459f10b39967a4b1bb
- SHA1 311635031f3d2bbb3141e80b47029309b569e419
- SHA512 b96f1f03d694320850512ba33c60ad74d485020174ab3f8facaaafbdfdd9fdbc4219a9896b03457899198265788ee722f1374d298d181a8fe34041d44715befb
- SSDEEP 6144:Kc8Uh7uSuJi0EEzqaEQFl5xbXXhJYyK5JqI/AH44sa2GI+OxW0Bsu936Sq9n0:KczhODx4L/AH44sa2GI+OxWG/
- TLSH
  T182C4F8922EB7D53A061FDBF65A6E0102FE2B6C8571245410795CF44C238EF09F2EDDAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.css
- Size 294KB
- SHA256 8d61f9e0aeeec43bdaf720bde7ead8e7d3de85f3497a0b784a723628c6d68dee
- MD5 ea5ab85681f5442fbfbcb4d410f200f2
- SHA1 5bd08fc669c7c830e88e0f37f7643a6a01e456ed
- SHA512 5d622a2702c58dbdded3b55c23e976bfbc2f451bf560ffb237919c5a612c893a69499e9d132619285ac79454468c78349c3d3741b41fa57343524c98b713c3d1
- SSDEEP 6144:UzsUTrsZ7KcNkuwcv2As0aMY/Y/RR9MtpWKco:UzsUTrsZXkW4/50i
- TLSH
  T15A54196F650A2B5A28DD28778596ED4EF4B4F0B2D8034FD4E8AE7F74804A7D8054736C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.js.map
- Size 7.4MB
- SHA256 fba53b92be1f134295d39baffe688bdfd4655fa9a9e4858b753c35a916da2e59
- MD5 5abca25e37ac31e4facd5d487c8ed3f0
- SHA1 28a089159e589a7b16df4c5c66afb31bf535bc02
- SHA512 f6d6c7fc5081528be68ab64adb5b19208ae4c670bfcbd460bcc6d3d974e3b8524c4c682060515a2c41e7ed7ccc7c3d7c72f02b5c1f79856d51ff7491e7ebadac
- SSDEEP 49152:ol9zwlCf/21YyTtluZRLYuwImeaBr8uabc6bvLFf+Xlef9CS11g1paG0kzInfL+O:y
- TLSH
  T138761A622DFBC63A0A5ECBDA69690142FD3F4C59B92014146968FC5C11CEB44F2FED3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.de.js.map
- Size 61KB
- SHA256 2ae1101ed290d2a00321ac614457d46dd86036ff40e8e45870338582195164ac
- MD5 706055126fa2ba0893bfa72ffd9561dd
- SHA1 2089770f0622434e20b017691fae6756b0e0bef7
- SHA512 22ec021d8c10374ac90e06415fdce05e192bfa669ea17ee04d131fce70d7fd4cef454fbb2ac2db79d0133e276f201a0658cafdd3dd6e8f8d3c2ef36679b33107
- SSDEEP 1536:hf3qNarNFAtg8P4RBaCvHw2SAiOG1Ejlj1np6HgtDkM/18TVY8OMvOItmCjhke5R:dX/jr7ItmCjhD
- TLSH
  T11653A2E159B3DC0E569D2F20B7C39FB336DBEDE97A52102A24A8F16710460E4F65EC11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.es.js.map
- Size 61KB
- SHA256 3e538b3d0b0ccaa9511cf97fc1575a7f3dbf4667d5e8ff75ba469a1c5a9f4e1b
- MD5 17d90e61cac3f0f28e6c47b39e8103cf
- SHA1 f1f2210c773375b4d8f7539221a757684c8b08f7
- SHA512 015d52096a6642793f2e92e7418632097d2d0833b4959394e5ceaff2b2f82863727710d68d4e3d2bff07d917bb8cf91a90c69767ca1f9f401016a2adc012194e
- SSDEEP 1536:1O3bwbZC/DHXynPSHNOtagcecllGVoaITm9fJnVsbem9qXxY5HVoTB11AUN0PleO:WD3FuuUNuleGRPh3
- TLSH
  T1B4532FD602EACF0654DF0B4DF2C3DB53F1C7ACC9B464C0A2B199F99750C8998EA2AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.fr.js.map
- Size 65KB
- SHA256 b016eb06c2f40477c5163060571c16e79b60095b3876c3e16c72a420359b7795
- MD5 bd5ff599189942ec1d9b1a82cf789da0
- SHA1 6dbf042c89b98ffb6f4707b9675acbfe9f78ae13
- SHA512 181998c1179bed09ecf8ae20f3e65817ed4734edb314de4eee78b1a26722c20f5f33b69d21a020efec0616783476b03b37b8842b6d9b79dc6d722e9bdd8709e9
- SSDEEP 1536:703kWYUarPCqQq37VFI+pGswZXRI3Jcy0ZO:70RYUarP0IVvpm6Jcy0c
- TLSH
  T1296352DF52E2EA4288CE1F52B5539F93B4E39CC8B3C5912178AAF18701C549CF79AD90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.it.js.map
- Size 63KB
- SHA256 90205c41cf93d7000669d7c111cf0d8247a2b6f15db96ceffd1618a208fc2122
- MD5 c92347c3b69db23b57b4b2a5576e79c3
- SHA1 d1652af7de35769bca78a615eb131011e8b4c324
- SHA512 30a589de23773a98d7ee6181be146a21940dd5b1ce6cd196b1ac15191283d2416991c65693dc2d76b9318ea79bc5ddecdd79067933114bbcd7498790f1f75bf5
- SSDEEP 1536:GPjm9scBOyRhSU+m7Oo0Nq/TvIdCalZwkg:sdm7Oo0Nq/TvIdCalZK
- TLSH
  T1DC5386F902F3DE04A88F1B59F1639B89F3D76CC8BA982021709CF56F2089994F25DE55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.ja.js.map
- Size 66KB
- SHA256 4392e296ed79d94fefedf1c0ccf782c04c0d921c8ac704e96c2e1e0c07cc613f
- MD5 238e55a15ea8aacc008f6bca973567d8
- SHA1 3ddccecfd75b3ea7a04a32195e7bccf14d6e2a14
- SHA512 03d68d4e6b0e2a9522a25c78557352a04bed2d6e817a3f84f8361c7dd0d2152f7cee9f15b06a55a28bc9122edb8f44273dd58124671aec666a3c68c785b1c850
- SSDEEP 768:lQP9Rode62Epv4A6wwYfXz20TWgqidkIRoooPeJ+R:lDv8fO26zJo
- TLSH
  T1D963FEEC57E2EC25491C5B62B99BBBD534879DD7F821323280ACF42759A02CCF115EB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.js.map
- Size 53KB
- SHA256 bb2054faed3765411ebfe51c3f61bbc6cbba0fcb87488a6a3504f5e6feb43421
- MD5 4ecaa0c692a0fda16a5e82e3690b4e12
- SHA1 c673a7c6c31f98eec3f27b9866e059ccc8313a81
- SHA512 20a80067bbe25ba3dec32164af11d7d5aea36eb17ab4bb730e9c1153d1023f63740e5da47e51e352561ed185ea805c0834f44a47300525892a4225e90989af03
- SSDEEP 768:Aka1dCB0d5b2hznJK3vgej/2UenRzDttZFW1nTnNQ120IbLJiKcOd7M7Zir:1a1dCB0d5bIKUBqiKcOd7M7Zir
- TLSH
  T11E335DD757A6CF2A684E0F2AB297DBE4B2DB9CE871510121749CF82711810A4F37FDA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.ko.js.map
- Size 61KB
- SHA256 5ac0428b7d229489ece1cc2001f9716d32cb57996a036925ac01fb750eecd3c9
- MD5 c1f3961fdccefb633ca4b8c14d9e9b71
- SHA1 3ebfa00b038cee2646c76036464710cd48d20f3a
- SHA512 4817fe3b93db961ffec2f181591b63621395122999a9afc691c6104c53f4d3466a198864b99ec9e87ac0db159452062d5a8756e80f6e507cf9d2c8f715cfcfcf
- SSDEEP 1536:WNehhbTm9FKxeoyRxKO9aPP3mcFlcliQvScJif:VmFSYI3mv+
- TLSH
  T1EE53EFD225B7DE48114E8F5575E3AB6873C3ECE2BB8300A0EC84FD66C954482E54AD7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.ru.js.map
- Size 90KB
- SHA256 0fcf1e9c577c05641cc789ce0bc1dc768e02012ab91e104822b5e65922a5a731
- MD5 779b49300502d3b6d093d75c4da1758b
- SHA1 79301adb0aae75316a2296cc5f724be4cf65fbee
- SHA512 e9b692b45c8859f13f0aa05c703937b446cadd4223bd636ce5d0c6d2068f4512651c511444da4b2dd3ef4f44c6db4e904240350f621f33679f29cddc7ad2fb45
- SSDEEP 1536:/KvEu0/aT5l2PIfsl/kW9bTKuxdYqrt1WONLf4hbosqf3j7U9x:/KvEOOesl/k8beuxVrtU6f4hks43j7U/
- TLSH
  T1419337B046ABD89D0108BA07ED056F0938EB49FE7F9B533215747D7BB4E3064C629E19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.zh-cn.js.map
- Size 50KB
- SHA256 c25dd9cbc5eefed43ec695cf137432f550c17e4042d26491d6c23c36cae302ad
- MD5 34e60e6b4c2bce253523d8b7d3128f4e
- SHA1 bf26cb36306bebfe0204a2f1f9becc271f5a2ae5
- SHA512 c9e332eef11c963bd97ab72de71b5da778d9c410c337dc086d6193a809b97505aa10fd3b862042ee65c45d73457683f95d0ede6b525b628522abff02112e7bdf
- SSDEEP 1536:KO5CCChyCEeFQC+QXtf7ZTnFaBhfprAf4WS9bsy903:wQC+Q5ZTnd
- TLSH
  T1EF3393C406BAEDB4288C1F69F75B8F8938C35FC7BA2A904160EAFC6F1480455F766E45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.zh-tw.js.map
- Size 51KB
- SHA256 bb9f35262f088b15f98f5f67204fcd9cef03def819745c99c14444fa9d728e3d
- MD5 e9ec0d4da76e25502ff8abe77ee74234
- SHA1 0be5b7a9cc39cf9222110ff56e9102a5dfaa14b2
- SHA512 c778c65d16fc4c2ad0c14e5a0d7ad27dbae56934b534eeeecff0ff58bf95df6def32d4fc0017ce2d7038ef8089edea3a3552dcdcd4d0dba3202e8a01cca02e55
- SSDEEP 1536:XMUC7Sj6HWA2HnMLDT7q/EygCY0nTudBkzbbGeAs4/o:M1LH7LA
- TLSH
  T14633B3E40ABBDE94244C6F7DF7571F8538CB6FC6BA21218160EDF9A70982144F366D82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  vengrom executor/Bin/Monaco Editor/vs/nano-theme.css
- Size 10KB
- SHA256 b0e82346c3924dcc5c8de126cef8488aa02eee4946b60663885f7e90704609b4
- MD5 ece01dfe1a89665fe669e550c82f2528
- SHA1 d832e1258b8a138e5fe3538a2c7fe9e4bcfeb19d
- SHA512 b77820c4cbfd5de1027d8164b3c734a3e96af43af289c5798889064488ab64940549daf3ce9e6be3c92449ae70afe7f3e9817298a8f1dd26655e61f18aa97c93
- SSDEEP 192:Zd0TT6vzCbPq8G/ljokesxl/s3sINsLI4bbzOrHg53wfR03sA0H0Ozj:rK8vLI4bXiHghOR03QH0Ij
- TLSH
  T16C220190B6691D1531DFC47FAD76F2AC23E89110C80DACE869EA7114CECE78CF1A3A55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32