BlackGuard | Threat Level: high | Type: Infostealer

Cryptographic Identifiers

SHA2562ce02a9f26d699d65588073a8f2be54e422cb28cdc69aabb89acb0250f2d2fe2
MD55abc4f85343b846275da1edf093fb1ba
File Typeexe
Size11514.4 KB
First Seen2026-02-08
File Name2ce02a9f26d699d65588073a8f2be54e422cb28cdc69aabb89acb0250f2d2fe2
TagsBlackGuard, exe, growtopia, UnixStealer, winrarsfx

Malware Family: BlackGuard

BlackGuard, stealer'dır.

TypeInfostealer
Programming LanguageC#/.NET
Target PlatformWindows
C2 ProtocolHTTP
PurposeStealer
First Seen Year2022

Threat Indicators (IOC)

  • SHA256: 2ce02a9f26d699d65588073a8f2be54e422cb28cdc69aabb89acb0250f2d2fe2
  • MD5: 5abc4f85343b846275da1edf093fb1ba

You can verify all hash values of this sample on VirusTotal.

System Cleanup Guide

  1. Disconnect the system from the network immediately
  2. Yeni bir cihazdan banka hesabı, sosyal medya ve e-posta şifrelerini değiştirin
  3. Move crypto wallets to a new address and abandon the old ones
  4. Start a full scan with up-to-date antivirus
  5. Clear saved browser passwords and enable 2FA
  6. Sign out of all sessions on every affected service

YARA Rule Hints

rule BlackGuard_SHA256 {
    meta:
        description = "BlackGuard sample: 2ce02a9f26d699d6"
        threat_level = "high"
        first_seen = "2026-02-08"
    condition:
        hash.sha256(0, filesize) == "2ce02a9f26d699d65588073a8f2be54e422cb28cdc69aabb89acb0250f2d2fe2"
}

BlackGuard — Malware Profile

BlackGuard .NET MaaS stealer 2022. $200/ay. 22+ kripto cuzdani. Rus dark web.

Malware Type
Infostealer
Programming Language
C#/.NET
C2 Protocol
HTTP
Target Systems
Windows

Technical Details

.NET, HTTPS C2 (Telegram/Discord C2 dead drop da destekli), browser stealer, kripto wallet stealer, VPN/FTP stealer, Discord/Steam token, USB propagation, clipper, screenshot

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC List (2 indicators)

IOC — BlackGuard
# SHA256 2ce02a9f26d699d65588073a8f2be54e422cb28cdc69aabb89acb0250f2d2fe2 # MD5 5abc4f85343b846275da1edf093fb1ba
TypeValueNote
sha256 2ce02a9f26d699d65588073a8f2be54e422cb28cdc69aabb89acb0250f2d2fe2 Sample:BlackGuard
md5 5abc4f85343b846275da1edf093fb1ba Sample:BlackGuard

C2 Servers (2 recorded servers for this family)

Address Type Port Protocol Status Country
blackguard.shop domain 443 HTTPS active —
5.182.86.125 ip 1337 TCP inactive RU

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
blackguardinfostealermalwarehighsha256hash-analizi