BlackGuard | Threat Level: high | Type: Infostealer

Cryptographic Identifiers

SHA2561cc0b85cabbabadddcdfccfd60b96ad24fb4efcd289e06d7d55cec91ef878474
MD588c0540020d6f5dddac5d2bf36f99863
File Typeexe
Size505.0 KB
First Seen2026-02-03
File Name1cc0b85cabbabadddcdfccfd60b96ad24fb4efcd289e06d7d55cec91ef878474
TagsBlackGuard, exe, xbinder

Malware Family: BlackGuard

BlackGuard, stealer'dır.

TypeInfostealer
Programming LanguageC#/.NET
Target PlatformWindows
C2 ProtocolHTTP
PurposeStealer
First Seen Year2022

Threat Indicators (IOC)

  • SHA256: 1cc0b85cabbabadddcdfccfd60b96ad24fb4efcd289e06d7d55cec91ef878474
  • MD5: 88c0540020d6f5dddac5d2bf36f99863

You can verify all hash values of this sample on VirusTotal.

System Cleanup Guide

  1. Disconnect the system from the network immediately
  2. Yeni bir cihazdan banka hesabı, sosyal medya ve e-posta şifrelerini değiştirin
  3. Move crypto wallets to a new address and abandon the old ones
  4. Start a full scan with up-to-date antivirus
  5. Clear saved browser passwords and enable 2FA
  6. Sign out of all sessions on every affected service

YARA Rule Hints

rule BlackGuard_SHA256 {
    meta:
        description = "BlackGuard sample: 1cc0b85cabbabadd"
        threat_level = "high"
        first_seen = "2026-02-03"
    condition:
        hash.sha256(0, filesize) == "1cc0b85cabbabadddcdfccfd60b96ad24fb4efcd289e06d7d55cec91ef878474"
}

BlackGuard — Malware Profile

BlackGuard .NET MaaS stealer 2022. $200/ay. 22+ kripto cuzdani. Rus dark web.

Malware Type
Infostealer
Programming Language
C#/.NET
C2 Protocol
HTTP
Target Systems
Windows

Technical Details

.NET, HTTPS C2 (Telegram/Discord C2 dead drop da destekli), browser stealer, kripto wallet stealer, VPN/FTP stealer, Discord/Steam token, USB propagation, clipper, screenshot

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC List (2 indicators)

IOC — BlackGuard
# SHA256 1cc0b85cabbabadddcdfccfd60b96ad24fb4efcd289e06d7d55cec91ef878474 # MD5 88c0540020d6f5dddac5d2bf36f99863
TypeValueNote
sha256 1cc0b85cabbabadddcdfccfd60b96ad24fb4efcd289e06d7d55cec91ef878474 Sample:BlackGuard
md5 88c0540020d6f5dddac5d2bf36f99863 Sample:BlackGuard

C2 Servers (2 recorded servers for this family)

Address Type Port Protocol Status Country
blackguard.shop domain 443 HTTPS active —
5.182.86.125 ip 1337 TCP inactive RU

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
blackguardinfostealermalwarehighsha256hash-analizi