| Hash / Info | Value |
|---|---|
| SHA256 | bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74 |
| MD5 | ec333982af0977d8af5a4984792a4385 |
| SHA1 | d5b7e49c6476766d45a18cdd150d0679a9529a5a |
| ImpHash | f34d5f2d4577ed6d9ceec516c1f5a744 |
| File Adi | AYReport_EN.exe |
| File Type | exe |
| Size | 10,041,344 bytes |
| First Seen | 2023-09-14 |
Tehdit Valuelendirmesi
Bu ornek, etkilenen sistemlerdeki hassas kimlik bilgilerini ve kisisel verileri toplayan bir bilgi hırsızı (infostealer) olarak siniflandirilmistir. Tarayici kayitli parolalar, cerezler, kripto para cüzdani verileri ve oturum tokenlari birincil hedefleridir.
Detected Capabilities
- Tarayici Kimlik Bilgileri
- Cerez Hirsizligi
- Kripto Cüzdan
- 2FA Kodu
- Sistem Bilgisi
MalwareBazaar Tags
Analysis Note
Bu ornek BlackGuard ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
BlackGuard — Malware Profile
BlackGuard .NET MaaS stealer 2022. $200/ay. 22+ kripto cuzdani. Rus dark web.
Technical Details
.NET, HTTPS C2 (Telegram/Discord C2 dead drop da destekli), browser stealer, kripto wallet stealer, VPN/FTP stealer, Discord/Steam token, USB propagation, clipper, screenshot
Capabilities & Behavior
IOC List (2 indicators)
# SHA256
bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74
# MD5
ec333982af0977d8af5a4984792a4385
| Type | Value | Note |
|---|---|---|
| sha256 | bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74 | |
| md5 | ec333982af0977d8af5a4984792a4385 |
C2 Servers (2 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| blackguard.shop | domain | 443 | HTTPS | active | — |
| 5.182.86.125 | ip | 1337 | TCP | inactive | RU |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.