BlackGuard stealer extends its capabilities in new variant

March 23, 2023  |  Ofer Caspi

AT&T Alien Labs researchers have discovered a new variant of BlackGuard stealer in the wild, infecting using spear phishing attacks. The malware evolved since its previous variant and now arrives with new capabilities.

Key takeaways:

  • BlackGuard steals user sensitive information from a wide range of applications and browsers.
  • The malware can hijack crypto wallets copied to clipboard.
  • The new variant is trying to propagate through removable media and shared devices.

Background

BlackGuard stealer is malware as a service sold in underground forums and Telegram since 2021, when a Russian user posted information about a new malware called BlackGuard. It was offered for $700 lifetime or $200 monthly, claiming it can collect information from a wide range of applications and browsers.

In November 2022, an update for BlackGuard was announced in Telegram by its developer. Along with the new features, the malware author suggests free help with installing the command & control panel (Figure 1)

announcement in Telegraph

Figure 1. Announcement of new malware version in its Telegram channel.

Analysis

When executed, BlackGuard first checks if another instance is running by creating a Mutex.

Then to ensure it will survive a system reboot, the malware adds itself to the “Run” registry key. The malware also checks if it's running in debugger mode by checking TickCount and checking if the current user belongs to a specific list to determine whether it is running in a malware sandbox environment. (Figure 2)

Blackguard avoiding detection

Figure 2. Malware will avoid execution if running under specific user names.

Now all is ready for stealing the user’s sensitive data. It collects all stolen information in a folder where each piece of data is stored in a specific folder, such as Browsers, Files, Telegram, etc. (Figure 3)

Blackguard main folder

Figure 3. BlackGuard main folder with stolen data divided into folders.

When it finishes collecting sensitive data, the malware will zip the main folder using the password “xNET3301LIVE” and send it to its command & control. (Figure 4)

Zipped exfiltration data

Figure 4. Zipping exfiltrated data with password and uploading to command & control.

Browser stealth

Along with collecting cookies, history and downloads of different browsers, BlackGuard also looks for the existence of special files and folders of different browsers. (This includes “Login Data”, AutoFill, History and Downloads. (Figure 5)

 Blackguard collecting browser information

Figure 5. Collecting browser information.

Below is the list of browsers BlackGuard is looking for:

Chromium

Chrome

ChromePlus

Iridium

7Star

CentBrowser

Chedot

Vivaldi

Kometa

Elements Browser

Epic Privacy Browser

uCozMedia

Sleipnir5

Citrio

Coowon

liebao

QIP Surf

Orbitum

Comodo Dragon

Amigo

Torch

Comodo

360Browser

Maxthon3

K-Melon

Sputnik

Nichrome

CocCoc

Uran

Chromodo

Opera

Brave-Browser

Edge

Edge Beta

OperaGX

CryptoTab browser

 

In addition, the malware steals Chrome, Edge, and Edge Beta browsers’ crypto currency addons data. It supports the addons listed below by looking for their hardcoded installation folder path in “Microsoft\Edge\User Data\Default\Local Extension Settings\”. For example, the specific folder for “Terra Stations” is “ajkhoeiiokighlmdnlakpjfoobnjinie”. BlackGuard looks for Edge/EdgeBeta addons listed below:

Auvitas

Math

Metamask

MTV

Rabet

Ronin

Yoroi

Zilpay

Exodus

Terra Station

Jaxx

 

 

For Chrome it looks for those addons:

Binance

Bitapp

Coin98

Equal

Guild

Iconex

Math

Mobox

Phantom

Tron

XinPay

Ton

Metamask

Sollet

Slope

Starcoin

Swash

Finnie

Keplr

Crocobit

Oxygen

Nifty

Keplr

Forbole X

Slope Wallet

Nabox Wallet

ONTO Wallet

Goby

FINX

Ale

Sender Wallet

Leap Wallet

Infinity Wallet

Zecrey

Maiar Wallet

Flint Wallet

Liquality

 

 

 

Cryptocurrency

The malware also steals cryptocurrency wallets. It copies the wallet directory for each of the following crypto wallets below and sends them to its command & control.

Zcash

Armory

Jaxx Liberty

Exodus

Ethereum

Electrum

Atomic

Guarda

Zap

Binance

Atomic

Frame

Solar wallet

Token Pocket

Infinity

 

It will also query the registry for the installation path of “Dash” and “Litecoin” keys and do the same.

Messaging and gaming applications:

BlackGuard supports the stealing of a wide range of messaging applications. For some of the applications such as Telegram, Discord and Pidgin, the malware has a specific handler for each. For example, for Discord, it copies all data for the following folders in the Application Data folder which stored the Discord tokens: “Discord\Local Storage\leveldb”, “Discord PTB\Local Storage\leveldb”, “Discord Canary\leveldb”. In addition, it copies all strings in files with the extension of “.txt” and “.ldb” if they match Discord’s token regular expression. (Figure 6)

BlackGuard stealing Discord data

Figure 6. Stealing Discord’s tokens and data.

Below is the list of messaging applications the malware looking to steal sensitive information from:

Discord

Telegram

Tox

Element

Miranda NG

Signal

Adamant-IM

Wire

WhatsApp

Vipole

Proxifier

Steam

Pdgin

Battlet net

 

 

Outlook, FTP, VPN, and other applications

BlackGuard steals login data and other sensitive information from additional communication programs. For email applications, the malware queries specific Outlook registry keys under the CURRENT_USER hive to extract user, password and server information. (Figure 7)

exfil of Outlook data

Figure 7. Exfiltration of Outlook stored information.

The malware also handles different FTP and VPN applications to extract stored users and passwords. For example, for NordVPN, the malware will search the application’s folder and if found, it parses all user.config files to extract the users and passwords. (Figure 8)

exfil NordVPN data

Figure 8. Exfiltrating NordVPN information.

In addition to Outlook and NordVPN, BlackGuard also steals information from WinSCP, FileZilla, OpenVPN, ProtonVPN and Total Commander.

Other data collected      

Additionally, the malware also collects information from the machine such as anti-virus software installed on the machine, external IP address, localization, file system information, OS and more.

New BlackGuard features

Crypto wallet hijacking

In addition to stealing crypto wallets saved/installed on the infected machine, BlackGuard is hijacking cryptocurrency addresses copied to clipboard (such as CTRL+C) and replacing them with the threat actor’s address. This can cause a victim to send crypto assets to the attacker without noticing it when trying to transfer/pay to other wallets. This is done by tracking any content copied to the clipboard and matching it to relative different crypto wallets’ regex. (Figure 9)

regex to search

Figure 9. Specific regex to search in clipboard for listed coins.

Once there is a match, the malware will query its command and control for the alternative wallet and replace it in the clipboard instead of the one that was copied by the user. The malware supports stealing the popular crypto assets below:

BTC (Bitcoin)

ETH (Ethereum)

XMR (Monero)

XLM (Stellar)

XRP (Ripple)

LTC (Litecoin)

NEC (Nectar)

BCH (Bitcoin Cash)

DASH

 

Propagate through shared / removable devices

Although this feature was limited since Windows 7 to be used only for CDROM, the malware copies itself to each available drive with an “autorun.inf” file that points to the malware to execute it automatically. This includes removable and shared devices. For example, if a USB device is connected to an old version of Windows, the malware will be executed automatically and infect the machine. (Figure 10)

BlackGuard propagating

Figure 10. Propagate to all available drives.

Download and execute additional malware with process injection

The new variant of BlackGuard downloads and executes additional malware from its command & control. The newly downloaded malware is injected and executed using the “Process Hollowing” method. With that the malware will be running under legitimate/whitelisted processes and can make more detection more difficult. (Figure 11)

BlackGuard process injection

Figure 11. Download and execute additional malware using process injection.

The targeted process is RuntimeDirectory folder, RegASM.exe (C:\Windows\Microsoft.NET\Framework64\runtime_version\RegAsm.exe)

Massive malware duplication

The malware copies itself to every folder in C:\ drive recursively, each folder the malware generates a random name to be copied to. This feature is not common for malware, and this is mostly annoying, as the malware gains no advantage from that.

Persistence
The malware added persistence to survive system reboot by adding itself under the “Run” registry key. (Figure 12)

BlackGuard registry persistence

Figure 12. Setting registry persistence.

Documents - stealth activity

The malware searches and sends to its command and control all documents end with extensions “.txt”, “.config”, “.docx”, “.doc”, “.rdp” in the user folders (including sub directories): “Desktop”, “My Documents”, UserProfile folder.

Detection methods

The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.

SURICATA IDS SIGNATURES

 

2035716: ET TROJAN BlackGuard_v2 Data Exfiltration Observed

2035398: ET TROJAN MSIL/BlackGuard Stealer Exfil Activity

 

Associated indicators (IOCs)

The following technical indicators are associated with the reported intelligence. A list of indicators is also available in the OTX Pulse. Please note, the pulse may include other activities related but out of the scope of the report.

TYPE

INDICATOR

DESCRIPTION

IP ADDRESS

http://23[.]83.114.131

Malware command & control

SHA256

88e9780ce5cac572013aebdd99d154fa0b61db12faffeff6f29f9d2800c915b3

Malware hash

 

Mapped to MITRE ATT&CK

The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques:

  • TA0001: Initial Access
    • T1091: Replication Through Removable Media
  • TA0002: Execution
    • T1106: Native API
    • T1047: Windows Management Instrumentation
  • TA0003: Persistence
    • T1547.001: Registry Run Keys / Startup Folder
  • TA0005: Defense Evasion
    • T1027: Obfuscated Files or Information
  • TA0006: Credential Access
    • T1003: OS Credential Dumping
    • T1539: Steal Web Session Cookie
    • T1528: Steal Application Access Token
    • T1552: Unsecured Credentials
      • .001: Credentials In Files
      • .002: Credentials In Files
  • TA0007: Discovery
    • T1010: Application Window Discovery
    • T1622: Debugger Evasion
    • T1083: File and Directory Discovery
    • T1057: Process Discovery
    • T1012: Query Registry
    • T1082: System Information Discovery
    • T1497: Virtualization/Sandbox Evasion
  • TA0008: Lateral Movement
    • T1091: Replication Through Removable Media
  • TA0009: Collection
    • T1115: Clipboard Data
    • T1213: Data from Information Repositories
    • T1005: Data from Local System
  • TA0011: Command and Control
    • T1071: Application Layer Protocol
    • T1105: Ingress Tool Transfer
  • TA0010: Exfiltration
    • T1020: Automated Exfiltration

Share this with others

Get price Free trial