BlackGuard | Threat Level: high | Type: Infostealer

Cryptographic Identifiers

SHA256718b103e715ec52d1663345e19a9c61ed7cee40a4feee7fa0615b0aebcb50ec9
MD5ad73e1ec6d99725ebc2185a430dd41b0
File Typezip
Size1990.6 KB
First Seen2025-04-24
File Name718b103e715ec52d1663345e19a9c61ed7cee40a4feee7fa0615b0aebcb50ec9.zip
TagsBlackGuard, CourtorderNo, zip

Malware Family: BlackGuard

BlackGuard, stealer'dır.

TypeInfostealer
Programming LanguageC#/.NET
Target PlatformWindows
C2 ProtocolHTTP
PurposeStealer
First Seen Year2022

Threat Indicators (IOC)

  • SHA256: 718b103e715ec52d1663345e19a9c61ed7cee40a4feee7fa0615b0aebcb50ec9
  • MD5: ad73e1ec6d99725ebc2185a430dd41b0

You can verify all hash values of this sample on VirusTotal.

System Cleanup Guide

  1. Disconnect the system from the network immediately
  2. Yeni bir cihazdan banka hesabı, sosyal medya ve e-posta şifrelerini değiştirin
  3. Move crypto wallets to a new address and abandon the old ones
  4. Start a full scan with up-to-date antivirus
  5. Clear saved browser passwords and enable 2FA
  6. Sign out of all sessions on every affected service

YARA Rule Hints

rule BlackGuard_SHA256 {
    meta:
        description = "BlackGuard sample: 718b103e715ec52d"
        threat_level = "high"
        first_seen = "2025-04-24"
    condition:
        hash.sha256(0, filesize) == "718b103e715ec52d1663345e19a9c61ed7cee40a4feee7fa0615b0aebcb50ec9"
}

BlackGuard — Malware Profile

BlackGuard .NET MaaS stealer 2022. $200/ay. 22+ kripto cuzdani. Rus dark web.

Malware Type
Infostealer
Programming Language
C#/.NET
C2 Protocol
HTTP
Target Systems
Windows

Technical Details

.NET, HTTPS C2 (Telegram/Discord C2 dead drop da destekli), browser stealer, kripto wallet stealer, VPN/FTP stealer, Discord/Steam token, USB propagation, clipper, screenshot

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC List (2 indicators)

IOC — BlackGuard
# SHA256 718b103e715ec52d1663345e19a9c61ed7cee40a4feee7fa0615b0aebcb50ec9 # MD5 ad73e1ec6d99725ebc2185a430dd41b0
TypeValueNote
sha256 718b103e715ec52d1663345e19a9c61ed7cee40a4feee7fa0615b0aebcb50ec9 Sample:BlackGuard
md5 ad73e1ec6d99725ebc2185a430dd41b0 Sample:BlackGuard

C2 Servers (2 recorded servers for this family)

Address Type Port Protocol Status Country
blackguard.shop domain 443 HTTPS active —
5.182.86.125 ip 1337 TCP inactive RU

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
blackguardinfostealermalwarehighsha256hash-analizi