AT&T Alien Labs researchers have discovered a new variant of BlackGuard stealer in the wild, infecting using spear phishing attacks. The malware evolved since its previous variant and now arrives with new capabilities.
BlackGuard steals user sensitive information from a wide range of applications and browsers.
The malware can hijack crypto wallets copied to clipboard.
The new variant is trying to propagate through removable media and shared devices.
BlackGuard stealer is malware as a service sold in underground forums and Telegram since 2021, when a Russian user posted information about a new malware called BlackGuard. It was offered for $700 lifetime or $200 monthly, claiming it can collect information from a wide range of applications and browsers.
In November 2022, an update for BlackGuard was announced in Telegram by its developer. Along with the new features, the malware author suggests free help with installing the command & control panel (Figure 1)
Figure 1. Announcement of new malware version in its Telegram channel.
When executed, BlackGuard first checks if another instance is running by creating a Mutex.
Then to ensure it will survive a system reboot, the malware adds itself to the “Run” registry key. The malware also checks if it’s running in debugger mode by checking TickCount and checking if the current user belongs to a specific list to determine whether it is running in a malware sandbox environment. (Figure 2)
Figure 2. Malware will avoid execution if running under specific user names.
Now all is ready for stealing the user’s sensitive data. It collects all stolen information in a folder where each piece of data is stored in a specific folder, such as Browsers, Files, Telegram, etc. (Figure 3)
Figure 3. BlackGuard main folder with stolen data divided into folders.
When it finishes collecting sensitive data, the malware will zip the main folder using the password “xNET3301LIVE” and send it to its command & control. (Figure 4)
Figure 4. Zipping exfiltrated data with password and uploading to command & control.
Along with collecting cookies, history and downloads of different browsers, BlackGuard also looks for the existence of special files and folders of different browsers. (This includes “Login Data”, AutoFill, History and Downloads. (Figure 5)
Figure 5. Collecting browser information.
Below is the list of browsers BlackGuard is looking for:
Epic Privacy Browser
In addition, the malware steals Chrome, Edge, and Edge Beta browsers’ crypto currency addons data. It supports the addons listed below by looking for their hardcoded installation folder path in “MicrosoftEdgeUser DataDefaultLocal Extension Settings”. For example, the specific folder for “Terra Stations” is “ajkhoeiiokighlmdnlakpjfoobnjinie”. BlackGuard looks for Edge/EdgeBeta addons listed below:
For Chrome it looks for those addons:
The malware also steals cryptocurrency wallets. It copies the wallet directory for each of the following crypto wallets below and sends them to its command & control.
It will also query the registry for the installation path of “Dash” and “Litecoin” keys and do the same.
Messaging and gaming applications:
BlackGuard supports the stealing of a wide range of messaging applications. For some of the applications such as Telegram, Discord and Pidgin, the malware has a specific handler for each. For example, for Discord, it copies all data for the following folders in the Application Data folder which stored the Discord tokens: “DiscordLocal Storageleveldb”, “Discord PTBLocal Storageleveldb”, “Discord Canaryleveldb”. In addition, it copies all strings in files with the extension of “.txt” and “.ldb” if they match Discord’s token regular expression. (Figure 6)
Figure 6. Stealing Discord’s tokens and data.
Below is the list of messaging applications the malware looking to steal sensitive information from:
Outlook, FTP, VPN, and other applications
BlackGuard steals login data and other sensitive information from additional communication programs. For email applications, the malware queries specific Outlook registry keys under the CURRENT_USER hive to extract user, password and server information. (Figure 7)
Figure 7. Exfiltration of Outlook stored information.
The malware also handles different FTP and VPN applications to extract stored users and passwords. For example, for NordVPN, the malware will search the application’s folder and if found, it parses all user.config files to extract the users and passwords. (Figure 8)
Figure 8. Exfiltrating NordVPN information.
In addition to Outlook and NordVPN, BlackGuard also steals information from WinSCP, FileZilla, OpenVPN, ProtonVPN and Total Commander.
Other data collected
Additionally, the malware also collects information from the machine such as anti-virus software installed on the machine, external IP address, localization, file system information, OS and more.
New BlackGuard features
Crypto wallet hijacking
In addition to stealing crypto wallets saved/installed on the infected machine, BlackGuard is hijacking cryptocurrency addresses copied to clipboard (such as CTRL+C) and replacing them with the threat actor’s address. This can cause a victim to send crypto assets to the attacker without noticing it when trying to transfer/pay to other wallets. This is done by tracking any content copied to the clipboard and matching it to relative different crypto wallets’ regex. (Figure 9)
Figure 9. Specific regex to search in clipboard for listed coins.
Once there is a match, the malware will query its command and control for the alternative wallet and replace it in the clipboard instead of the one that was copied by the user. The malware supports stealing the popular crypto assets below:
BCH (Bitcoin Cash)
Propagate through shared / removable devices
Although this feature was limited since Windows 7 to be used only for CDROM, the malware copies itself to each available drive with an “autorun.inf” file that points to the malware to execute it automatically. This includes removable and shared devices. For example, if a USB device is connected to an old version of Windows, the malware will be executed automatically and infect the machine. (Figure 10)
Figure 10. Propagate to all available drives.
Download and execute additional malware with process injection
The new variant of BlackGuard downloads and executes additional malware from its command & control. The newly downloaded malware is injected and executed using the “Process Hollowing” method. With that the malware will be running under legitimate/whitelisted processes and can make more detection more difficult. (Figure 11)
Figure 11. Download and execute additional malware using process injection.
The targeted process is RuntimeDirectory folder, RegASM.exe (C:WindowsMicrosoft.NETFramework64runtime_versionRegAsm.exe)
Massive malware duplication
The malware copies itself to every folder in C: drive recursively, each folder the malware generates a random name to be copied to. This feature is not common for malware, and this is mostly annoying, as the malware gains no advantage from that.
The malware added persistence to survive system reboot by adding itself under the “Run” registry key. (Figure 12)
Figure 12. Setting registry persistence.
Documents – stealth activity
The malware searches and sends to its command and control all documents end with extensions “.txt”, “.config”, “.docx”, “.doc”, “.rdp” in the user folders (including sub directories): “Desktop”, “My Documents”, UserProfile folder.
The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.
SURICATA IDS SIGNATURES
2035716: ET TROJAN BlackGuard_v2 Data Exfiltration Observed
2035398: ET TROJAN MSIL/BlackGuard Stealer Exfil Activity
Associated indicators (IOCs)
The following technical indicators are associated with the reported intelligence. A list of indicators is also available in the OTX Pulse. Please note, the pulse may include other activities related but out of the scope of the report.
Malware command & control
Mapped to MITRE ATT&CK
The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques:
TA0001: Initial Access
T1091: Replication Through Removable Media
T1106: Native API
T1047: Windows Management Instrumentation
T1547.001: Registry Run Keys / Startup Folder
TA0005: Defense Evasion
T1027: Obfuscated Files or Information
TA0006: Credential Access
T1003: OS Credential Dumping
T1539: Steal Web Session Cookie
T1528: Steal Application Access Token
T1552: Unsecured Credentials
.001: Credentials In Files
.002: Credentials In Files
T1010: Application Window Discovery
T1622: Debugger Evasion
T1083: File and Directory Discovery
T1057: Process Discovery
T1012: Query Registry
T1082: System Information Discovery
T1497: Virtualization/Sandbox Evasion
TA0008: Lateral Movement
T1091: Replication Through Removable Media
T1115: Clipboard Data
T1213: Data from Information Repositories
T1005: Data from Local System
TA0011: Command and Control
T1071: Application Layer Protocol
T1105: Ingress Tool Transfer
T1020: Automated Exfiltration
Friday Squid Blogging: Light-Emitting Squid
It’s a Taningia danae: Their arms are lined with two rows of sharp retractable hooks. And, like most deep-sea squid,...
University of Manchester Suffers Suspected Data Breach During Cyber Incident
The University is working with authorities to resolve the incident and understand what data has been accessed Read More
Barracuda: Immediately rip out and replace our security hardware
Barracuda Networks is taking the unusual step of telling its customers to physically remove and decommission its hardware. Read More
Google launches Secure AI Framework to help secure AI technology
Google has announced the launch of the Secure AI Framework (SAIF), a conceptual framework for securing AI systems. Google, owner...
Barracuda Urges Swift Replacement of Vulnerable ESG Appliances
Investigating the ESG bug, Rapid7 assumed the presence of persistent malware hindering device wipes Read More
Operation Triangulation: Zero-Click iPhone Malware
Kaspersky is reporting a zero-click iOS exploit in the wild: Mobile device backups contain a partial copy of the filesystem,...