AlienVault Blogs

Syndicate content
The most recent posts from across the AlienVault blogs.
Updated: 44 min 10 sec ago

BlackGuard stealer extends its capabilities in new variant

Thu, 2023/03/23 - 12:00
AT&T Alien Labs researchers have discovered a new variant of BlackGuard stealer in the wild, infecting using spear phishing attacks. The malware evolved since its previous variant and now arrives with new capabilities. Key takeaways:
  • BlackGuard steals user sensitive information from a wide range of applications and browsers.
  • The malware can hijack crypto wallets copied to clipboard.
  • The new variant is trying to propagate through removable media and shared devices.
Background BlackGuard stealer is malware as a service sold in underground forums and Telegram since 2021, when a Russian user posted information about a new malware called BlackGuard. It was offered for $700 lifetime or $200 monthly, claiming it can collect information from a wide range of applications and browsers. In November 2022, an update for BlackGuard was announced in Telegram by its developer. Along with the new features, the malware author suggests free help with installing the command & control panel (Figure 1) Figure 1. Announcement of new malware version in its Telegram channel. Analysis When executed, BlackGuard first checks if another instance is running by creating a Mutex. Then to ensure it will survive a system reboot, the malware adds itself to the “Run” registry key. The malware also checks if it's running in debugger mode by checking TickCount and checking if the current user belongs to a specific list to determine whether it is running in a malware sandbox environment. (Figure 2) Figure 2. Malware will avoid execution if running under specific user names. Now all is ready for stealing the user’s sensitive data. It collects all stolen information in a folder where each piece of data is stored in a specific folder, such as Browsers, Files, Telegram, etc. (Figure 3) Figure 3. BlackGuard main folder with stolen data divided into folders. When it finishes collecting sensitive data, the malware will zip the main folder using the password “xNET3301LIVE” and send it to its command & control. (Figure 4) Figure 4. Zipping exfiltrated data with password and uploading to command & control. Browser stealth Along with collecting cookies, history and downloads of different browsers, BlackGuard also looks for the existence of special files and folders of different browsers. (This includes “Login Data”, AutoFill, History and Downloads. (Figure 5)   Figure 5. Collecting browser information. Below is the list of browsers BlackGuard is looking for: Chromium Chrome ChromePlus Iridium 7Star CentBrowser Chedot Vivaldi Kometa Elements Browser Epic Privacy Browser uCozMedia Sleipnir5 Citrio Coowon liebao QIP Surf Orbitum Comodo Dragon Amigo Torch Comodo 360Browser Maxthon3 K-Melon Sputnik Nichrome CocCoc Uran Chromodo Opera Brave-Browser Edge Edge Beta OperaGX CryptoTab browser   In addition, the malware steals Chrome, Edge, and Edge Beta browsers’ crypto currency addons data. It supports the addons listed below by looking for their hardcoded installation folder path in “Microsoft\Edge\User Data\Default\Local Extension Settings\”. For example, the specific folder for “Terra Stations” is “ajkhoeiiokighlmdnlakpjfoobnjinie”. BlackGuard looks for Edge/EdgeBeta addons listed below: Auvitas Math Metamask MTV Rabet Ronin Yoroi Zilpay Exodus Terra Station Jaxx     For Chrome it looks for those addons: Binance Bitapp Coin98 Equal Guild Iconex Math Mobox Phantom Tron XinPay Ton Metamask Sollet Slope Starcoin Swash Finnie Keplr Crocobit Oxygen Nifty Keplr Forbole X Slope Wallet Nabox Wallet ONTO Wallet Goby FINX Ale Sender Wallet Leap Wallet Infinity Wallet Zecrey Maiar Wallet Flint Wallet Liquality       Cryptocurrency The malware also steals cryptocurrency wallets. It copies the wallet directory for each of the following crypto wallets below and sends them to its command & control. Zcash Armory Jaxx Liberty Exodus Ethereum Electrum Atomic Guarda Zap Binance Atomic Frame Solar wallet Token Pocket Infinity   It will also query the registry for the installation path of “Dash” and “Litecoin” keys and do the same. Messaging and gaming applications: BlackGuard supports the stealing of a wide range of messaging applications. For some of the applications such as Telegram, Discord and Pidgin, the malware has a specific handler for each. For example, for Discord, it copies all data for the following folders in the Application Data folder which stored the Discord tokens: “Discord\Local Storage\leveldb”, “Discord PTB\Local Storage\leveldb”, “Discord Canary\leveldb”. In addition, it copies all strings in files with the extension of “.txt” and “.ldb” if they match Discord’s token regular expression. (Figure 6) Figure 6. Stealing Discord’s tokens and data. Below is the list of messaging applications the malware looking to steal sensitive information from: Discord Telegram Tox Element Miranda NG Signal Adamant-IM Wire WhatsApp Vipole Proxifier Steam Pdgin Battlet net     Outlook, FTP, VPN, and other applications BlackGuard steals login data and other sensitive information from additional communication programs. For email applications, the malware queries specific Outlook registry keys under the CURRENT_USER hive to extract user, password and server information. (Figure 7) Figure 7. Exfiltration of Outlook stored information. The malware also handles different FTP and VPN applications to extract stored users and passwords. For example, for NordVPN, the malware will search the application’s folder and if found, it parses all user.config files to extract the users and passwords. (Figure 8) Figure 8. Exfiltrating NordVPN information. In addition to Outlook and NordVPN, BlackGuard also steals information from WinSCP, FileZilla, OpenVPN, ProtonVPN and Total Commander. Other data collected       Additionally, the malware also collects information from the machine such as anti-virus software installed on the machine, external IP address, localization, file system information, OS and more. New BlackGuard features Crypto wallet hijacking In addition to stealing crypto wallets saved/installed on the infected machine, BlackGuard is hijacking cryptocurrency addresses copied to clipboard (such as CTRL+C) and replacing them with the threat actor’s address. This can cause a victim to send crypto assets to the attacker without noticing it when trying to transfer/pay to other wallets. This is done by tracking any content copied to the clipboard and matching it to relative different crypto wallets’ regex. (Figure 9) Figure 9. Specific regex to search in clipboard for listed coins. Once there is a match, the malware will query its command and control for the alternative wallet and replace it in the clipboard instead of the one that was copied by the user. The malware supports stealing the popular crypto assets below: BTC (Bitcoin) ETH (Ethereum) XMR (Monero) XLM (Stellar) XRP (Ripple) LTC (Litecoin) NEC (Nectar) BCH (Bitcoin Cash) DASH   Propagate through shared / removable devices Although this feature was limited since Windows 7 to be used only for CDROM, the malware copies itself to each available drive with an “autorun.inf” file that points to the malware to execute it automatically. This includes removable and shared devices. For example, if a USB device is connected to an old version of Windows, the malware will be executed automatically and infect the machine. (Figure 10) Figure 10. Propagate to all available drives. Download and execute additional malware with process injection The new variant of BlackGuard downloads and executes additional malware from its command & control. The newly downloaded malware is injected and executed using the “Process Hollowing” method. With that the malware will be running under legitimate/whitelisted processes and can make more detection more difficult. (Figure 11) Figure 11. Download and execute additional malware using process injection. The targeted process is RuntimeDirectory folder, RegASM.exe (C:\Windows\Microsoft.NET\Framework64\runtime_version\RegAsm.exe) Massive malware duplication The malware copies itself to every folder in C:\ drive recursively, each folder the malware generates a random name to be copied to. This feature is not common for malware, and this is mostly annoying, as the malware gains no advantage from that. Persistence
The malware added persistence to survive system reboot by adding itself under the “Run” registry key. (Figure 12) Figure 12. Setting registry persistence. Documents - stealth activity The malware searches and sends to its command and control all documents end with extensions “.txt”, “.config”, “.docx”, “.doc”, “.rdp” in the user folders (including sub directories): “Desktop”, “My Documents”, UserProfile folder. Detection methods The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research. SURICATA IDS SIGNATURES   2035716: ET TROJAN BlackGuard_v2 Data Exfiltration Observed 2035398: ET TROJAN MSIL/BlackGuard Stealer Exfil Activity   Associated indicators (IOCs) The following technical indicators are associated with the reported intelligence. A list of indicators is also available in the OTX Pulse. Please note, the pulse may include other activities related but out of the scope of the report. TYPE INDICATOR DESCRIPTION IP ADDRESS http://23[.]83.114.131 Malware command & control SHA256 88e9780ce5cac572013aebdd99d154fa0b61db12faffeff6f29f9d2800c915b3 Malware hash   Mapped to MITRE ATT&CK The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques:
  • TA0001: Initial Access
    • T1091: Replication Through Removable Media
  • TA0002: Execution
    • T1106: Native API
    • T1047: Windows Management Instrumentation
  • TA0003: Persistence
    • T1547.001: Registry Run Keys / Startup Folder
  • TA0005: Defense Evasion
    • T1027: Obfuscated Files or Information
  • TA0006: Credential Access
    • T1003: OS Credential Dumping
    • T1539: Steal Web Session Cookie
    • T1528: Steal Application Access Token
    • T1552: Unsecured Credentials
      • .001: Credentials In Files
      • .002: Credentials In Files
  • TA0007: Discovery
    • T1010: Application Window Discovery
    • T1622: Debugger Evasion
    • T1083: File and Directory Discovery
    • T1057: Process Discovery
    • T1012: Query Registry
    • T1082: System Information Discovery
    • T1497: Virtualization/Sandbox Evasion
  • TA0008: Lateral Movement
    • T1091: Replication Through Removable Media
  • TA0009: Collection
    • T1115: Clipboard Data
    • T1213: Data from Information Repositories
    • T1005: Data from Local System
  • TA0011: Command and Control
    • T1071: Application Layer Protocol
    • T1105: Ingress Tool Transfer
  • TA0010: Exfiltration
    • T1020: Automated Exfiltration
Categories: Security Posts