BlackGuard Stealer

MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Execution T1204 User Execution

The stealer is written in C# and is obfuscated using Obfuscar tool... The TA has encoded a few strings using base64 and gzip compression

It is mostly distributed through malicious software disguised as Windows Update file, Fake MS Office Installer, Computer cleaner software, etc.

Now, it checks whether the execution is performed in the sandbox environment and whether the AntiVirus Product is installed. This is done by checking whether a specific library exists in the infected PC environment, and if a related library is detected, BlackGuard terminates itself.

The malware uses the Sleep() function several times as an anti-sandbox technique during its execution.

Before BlackGuard collects credentials and device information, it uses Anti Debugging methods. It detects the decompiler by checking if the “dnSpy.xml” file exists, and uses “Sleep()” and “DateTime.Now.Ticks” to determine whether it is being debugged.

After this, the malware checks for Discord tokens... extracts Discord tokens from them using regular expression.

MITRE ATT&CK® Techniques ... Credential Access ... T1539 Steal Web Session Cookie

If it finds a targeted VPN service, it steals the credentials from the configuration files, such as user.config

The malware reads the files key3.db, key4.db, logins.json, and cert9.db to steal browser data such as passwords, credit cards, history, and auto-filled data.

While Chrome and Edge browsers’ user data includes CC, Password, Cookie, History, Downloads, and AutoFill, and Gecko-based browsers additionally collect logins.json, which contains login information, key3.db, and key4.db.

MITRE ATT&CK® Techniques ... Discovery T1007 System Service Discovery

MITRE ATT&CK® Techniques ... Discovery T1057 Process Discovery

Device information is stored in information.txt. It includes OS Version, CPU architecture, malware file location, screen size, current date and time, HWID, IPv4, country, and malware execution time.

MITRE ATT&CK® Techniques ... Discovery T1087 Account Discovery

MITRE ATT&CK® Techniques ... Discovery T1124 System Time Discovery

Now, it checks whether the execution is performed in the sandbox environment and whether the AntiVirus Product is installed. This is done by checking whether a specific library exists in the infected PC environment, and if a related library is detected, BlackGuard terminates itself.

The malware uses the Sleep() function several times as an anti-sandbox technique during its execution.

The malware first checks whether a VPN is installed or not by checking the directory “C:\Users\[username]\AppData\Local\[VPN name]”

After this, the malware identifies the user’s geolocation by sending a request to hxxps[:]//freegeoip[.]app/xml/.

If the country of the infected device matches one of the lists below, the execution is terminated.

Before BlackGuard collects credentials and device information, it uses Anti Debugging methods. It detects the decompiler by checking if the “dnSpy.xml” file exists, and uses “Sleep()” and “DateTime.Now.Ticks” to determine whether it is being debugged.

BlackGuard browses Desktop, MyDocuments, and USERPROFILE\source path to steal specific files. It copies files with a file size of less than 2.5MB and has an extension such as *.txt, *.config, and *.rdp to the Files folder.

It then takes the screenshot of the victim’s system and saves it as “Screen.png”

After collecting information, the folder is compressed to a *.zip file and exfiltrated through Telegram API.

BlackGuard Stealer contains XOR-ed data inside a specific class used for stealing credentials and sensitive information, and each version has a different data or decoding method.

Send the zip file to the C2 server using HTTP/HTTPS protocol

MITRE ATT&CK® Techniques ... Command and Control T1095 Non-Application Layer Protocol

BlackGuard v2.4 downloaded SQLite.Interop.dll file using WebClient.DownloadData() function from external C2 Server

The TA in this sample is using Telegram for exfiltrating the data... hxxps[:]//api.telegram.org/bot/sendDocument?chat_id=

After collecting information, the folder is compressed to a *.zip file and exfiltrated through Telegram API.

Early versions of BlackGuard utilize Telegram Bot API to transfer compressed files to C2 Server.