AT&T Alien Labs researchers have discovered a new variant of BlackGuard stealer in the wild, infecting using spear phishing attacks. The malware evolved since its previous variant and now arrives with new capabilities.
Key takeaways:
- BlackGuard steals user sensitive information from a wide range of applications and browsers.
- The malware can hijack crypto wallets copied to clipboard.
- The new variant is trying to propagate through removable media and shared devices.
Background
BlackGuard stealer is malware as a service sold in underground forums and Telegram since
2021, when a Russian user posted information about a new malware called BlackGuard. It was offered for $700 lifetime or $200 monthly, claiming it can collect information from a wide range of applications and browsers.
In November 2022, an update for BlackGuard was announced in Telegram by its developer. Along with the new features, the malware author suggests free help with installing the command & control panel (Figure 1)
Figure 1. Announcement of new malware version in its Telegram channel.
Analysis
When executed, BlackGuard first checks if another instance is running by creating a Mutex.
Then to ensure it will survive a system reboot, the malware adds itself to the “Run” registry key. The malware also checks if it's running in debugger mode by checking TickCount and checking if the current user belongs to a specific list to determine whether it is running in a malware sandbox environment. (Figure 2)
Figure 2. Malware will avoid execution if running under specific user names.
Now all is ready for stealing the user’s sensitive data. It collects all stolen information in a folder where each piece of data is stored in a specific folder, such as Browsers, Files, Telegram, etc. (Figure 3)
Figure 3. BlackGuard main folder with stolen data divided into folders.
When it finishes collecting sensitive data, the malware will zip the main folder using the password “xNET3301LIVE” and send it to its command & control. (Figure 4)
Figure 4. Zipping exfiltrated data with password and uploading to command & control.
Browser stealth
Along with collecting cookies, history and downloads of different browsers, BlackGuard also looks for the existence of special files and folders of different browsers. (This includes “Login Data”, AutoFill, History and Downloads. (Figure 5)
Figure 5. Collecting browser information.
Below is the list of browsers BlackGuard is looking for:
Chromium
Chrome
ChromePlus
Iridium
7Star
CentBrowser
Chedot
Vivaldi
Kometa
Elements Browser
Epic Privacy Browser
uCozMedia
Sleipnir5
Citrio
Coowon
liebao
QIP Surf
Orbitum
Comodo Dragon
Amigo
Torch
Comodo
360Browser
Maxthon3
K-Melon
Sputnik
Nichrome
CocCoc
Uran
Chromodo
Opera
Brave-Browser
Edge
Edge Beta
OperaGX
CryptoTab browser
In addition, the malware steals Chrome, Edge, and Edge Beta browsers’ crypto currency addons data. It supports the addons listed below by looking for their hardcoded installation folder path in “Microsoft\Edge\User Data\Default\Local Extension Settings\”. For example, the specific folder for “Terra Stations” is “ajkhoeiiokighlmdnlakpjfoobnjinie”. BlackGuard looks for Edge/EdgeBeta addons listed below:
Auvitas
Math
Metamask
MTV
Rabet
Ronin
Yoroi
Zilpay
Exodus
Terra Station
Jaxx
For Chrome it looks for those addons:
Binance
Bitapp
Coin98
Equal
Guild
Iconex
Math
Mobox
Phantom
Tron
XinPay
Ton
Metamask
Sollet
Slope
Starcoin
Swash
Finnie
Keplr
Crocobit
Oxygen
Nifty
Keplr
Forbole X
Slope Wallet
Nabox Wallet
ONTO Wallet
Goby
FINX
Ale
Sender Wallet
Leap Wallet
Infinity Wallet
Zecrey
Maiar Wallet
Flint Wallet
Liquality
Cryptocurrency
The malware also steals cryptocurrency wallets. It copies the wallet directory for each of the following crypto wallets below and sends them to its command & control.
Zcash
Armory
Jaxx Liberty
Exodus
Ethereum
Electrum
Atomic
Guarda
Zap
Binance
Atomic
Frame
Solar wallet
Token Pocket
Infinity
It will also query the registry for the installation path of “Dash” and “Litecoin” keys and do the same.
Messaging and gaming applications:
BlackGuard supports the stealing of a wide range of messaging applications. For some of the applications such as Telegram, Discord and Pidgin, the malware has a specific handler for each. For example, for Discord, it copies all data for the following folders in the Application Data folder which stored the Discord tokens: “Discord\Local Storage\leveldb”, “Discord PTB\Local Storage\leveldb”, “Discord Canary\leveldb”. In addition, it copies all strings in files with the extension of “.txt” and “.ldb” if they match Discord’s token regular expression. (Figure 6)
Figure 6. Stealing Discord’s tokens and data.
Below is the list of messaging applications the malware looking to steal sensitive information from:
Discord
Telegram
Tox
Element
Miranda NG
Signal
Adamant-IM
Wire
WhatsApp
Vipole
Proxifier
Steam
Pdgin
Battlet net
Outlook, FTP, VPN, and other applications
BlackGuard steals login data and other sensitive information from additional communication programs. For email applications, the malware queries specific Outlook registry keys under the CURRENT_USER hive to extract user, password and server information. (Figure 7)
Figure 7. Exfiltration of Outlook stored information.
The malware also handles different FTP and VPN applications to extract stored users and passwords. For example, for NordVPN, the malware will search the application’s folder and if found, it parses all user.config files to extract the users and passwords. (Figure 8)
Figure 8. Exfiltrating NordVPN information.
In addition to Outlook and NordVPN, BlackGuard also steals information from WinSCP, FileZilla, OpenVPN, ProtonVPN and Total Commander.
Other data collected
Additionally, the malware also collects information from the machine such as anti-virus software installed on the machine, external IP address, localization, file system information, OS and more.
New BlackGuard features
Crypto wallet hijacking
In addition to stealing crypto wallets saved/installed on the infected machine, BlackGuard is hijacking cryptocurrency addresses copied to clipboard (such as CTRL+C) and replacing them with the threat actor’s address. This can cause a victim to send crypto assets to the attacker without noticing it when trying to transfer/pay to other wallets. This is done by tracking any content copied to the clipboard and matching it to relative different crypto wallets’ regex. (Figure 9)
Figure 9. Specific regex to search in clipboard for listed coins.
Once there is a match, the malware will query its command and control for the alternative wallet and replace it in the clipboard instead of the one that was copied by the user. The malware supports stealing the popular crypto assets below:
BTC (Bitcoin)
ETH (Ethereum)
XMR (Monero)
XLM (Stellar)
XRP (Ripple)
LTC (Litecoin)
NEC (Nectar)
BCH (Bitcoin Cash)
DASH
Propagate through shared / removable devices
Although this feature was limited since Windows 7 to be used only for CDROM, the malware copies itself to each available drive with an “
autorun.inf” file that points to the malware to execute it automatically. This includes removable and shared devices. For example, if a USB device is connected to an old version of Windows, the malware will be executed automatically and infect the machine. (Figure 10)
Figure 10. Propagate to all available drives.
Download and execute additional malware with process injection
The new variant of BlackGuard downloads and executes additional malware from its command & control. The newly downloaded malware is injected and executed using the “
Process Hollowing” method. With that the malware will be running under legitimate/whitelisted processes and can make more detection more difficult. (Figure 11)
Figure 11. Download and execute additional malware using process injection.
The targeted process is RuntimeDirectory folder, RegASM.exe (C:\Windows\Microsoft.NET\Framework64\runtime_version\RegAsm.exe)
Massive malware duplication
The malware copies itself to every folder in C:\ drive recursively, each folder the malware generates a random name to be copied to. This feature is not common for malware, and this is mostly annoying, as the malware gains no advantage from that.
Persistence
The malware added persistence to survive system reboot by adding itself under the “Run” registry key. (Figure 12)
Figure 12. Setting registry persistence.
Documents - stealth activity
The malware searches and sends to its command and control all documents end with extensions “.txt”, “.config”, “.docx”, “.doc”, “.rdp” in the user folders (including sub directories): “Desktop”, “My Documents”, UserProfile folder.
Detection methods
The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.
SURICATA IDS SIGNATURES
2035716: ET TROJAN BlackGuard_v2 Data Exfiltration Observed
2035398: ET TROJAN MSIL/BlackGuard Stealer Exfil Activity
Associated indicators (IOCs)
The following technical indicators are associated with the reported intelligence. A list of indicators is also available in the
OTX Pulse. Please note, the pulse may include other activities related but out of the scope of the report.
TYPE
INDICATOR
DESCRIPTION
IP ADDRESS
http://23[.]83.114.131
Malware command & control
SHA256
88e9780ce5cac572013aebdd99d154fa0b61db12faffeff6f29f9d2800c915b3
Malware hash
Mapped to MITRE ATT&CK
The findings of this report are mapped to the following
MITRE ATT&CK Matrix techniques:
- TA0001: Initial Access
- T1091: Replication Through Removable Media
- TA0002: Execution
- T1106: Native API
- T1047: Windows Management Instrumentation
- TA0003: Persistence
- T1547.001: Registry Run Keys / Startup Folder
- TA0005: Defense Evasion
- T1027: Obfuscated Files or Information
- TA0006: Credential Access
- T1003: OS Credential Dumping
- T1539: Steal Web Session Cookie
- T1528: Steal Application Access Token
- T1552: Unsecured Credentials
- .001: Credentials In Files
- .002: Credentials In Files
- TA0007: Discovery
- T1010: Application Window Discovery
- T1622: Debugger Evasion
- T1083: File and Directory Discovery
- T1057: Process Discovery
- T1012: Query Registry
- T1082: System Information Discovery
- T1497: Virtualization/Sandbox Evasion
- TA0008: Lateral Movement
- T1091: Replication Through Removable Media
- TA0009: Collection
- T1115: Clipboard Data
- T1213: Data from Information Repositories
- T1005: Data from Local System
- TA0011: Command and Control
- T1071: Application Layer Protocol
- T1105: Ingress Tool Transfer
- TA0010: Exfiltration
- T1020: Automated Exfiltration
