{"id":13912,"date":"2023-03-24T08:57:40","date_gmt":"2023-03-24T08:57:40","guid":{"rendered":"https:\/\/gridinsoft.com\/blogs\/?p=13912"},"modified":"2023-04-12T03:36:32","modified_gmt":"2023-04-12T03:36:32","slug":"blackguard-update-cryptowallets","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/blackguard-update-cryptowallets\/","title":{"rendered":"BlackGuard Receives Update, Targets More Cryptowallets"},"content":{"rendered":"

BlackGuard, a prolific infostealer malware, received an update at the edge of 2023. The new update introduced advanced data-stealing capabilities and secure connectivity features. The new version also includes a row of new anti-detection and anti-analysis capabilities<\/strong>. Let\u2019s have a more detailed look into this malware and see the difference from all aspects.<\/p>\n

BlackGuard Stealer \u2013 What is it?<\/h2>\n

BlackGuard is a classic infostealer malware, programmed in C#<\/strong>. It aims at grabbing personal data from web browsers, particularly seeking data related to cryptocurrency wallets. It first appeared in 2021, being promoted both on Darknet forums<\/a> and in a dedicated Telegram community. A lifetime subscription for this malware costs $700<\/strong>, while a monthly subscription is available for $200. Its promotion campaign saw a major boost in 2022, when its competitor Raccoon<\/a> went for a hiatus.<\/p>\n

From its beginning, BlackGuard was aiming precisely at stealing crypto credentials<\/a>, and this remained its bearing point in further updates. November 2022 patch brought overall improvements to the way malware gathers cryptocurrency-related data<\/strong>, but also introduces the ability to load other malware, i.e. act as a dropper<\/a>. Patch notes published in the Telegram community contain information about a pack of other changes, mostly related to C2 connectivity.<\/p>\n

\"BlackGuard
Telegram post that promotes updated BlackGuard version<\/figcaption><\/figure>\n

Anti-analysis tactics<\/h2>\n

First notable thing about BlackGuard malware is its anti-analysis measures. BlackGuard typically arrives at a target device in an encrypted form. The encryption is done by a tool embedded into the admin panel<\/a> of the malware. Additionally, its code is obfuscated in a pretty specific manner: base64-encoded strings are getting decoded only during the runtime<\/strong>. But even before the decoding, the strings are represented as an array of bytes \u2013 a completely unreadable one. Such a practice appears to be pretty effective against anti-malware programs that try to analyze the strings.<\/p>\n

Malware also checks the computer name, seeking a match with the hardcoded list it brings among its code rows<\/strong>. These are the names typically applied to virtual machines or live systems used in virus analysis. If the one is detected, BlackGuard will cease any further execution. Debugging, however, also receives its treatment \u2013 malware can block any inputs if it detects the activity of a debug tool. Typically for all malware developed in Russia and ex-USSR countries, , this stealer refuses to run in ex-USSR countries<\/strong>.<\/p>\n

\"Antianalysis
List of usernames which are not acceptable for BlackGuard<\/figcaption><\/figure>\n

Data stealing<\/h2>\n

Once all the checkups are passed, the malware starts its main course \u2013 credentials stealing. As I mentioned above, BlackGuard\u2019s primary target is login information contained in web browsers, and one related to cryptocurrency wallets both as a browser extension and desktop application. It seeks the AppData\/Local folder<\/strong> for the directories that belong to web browsers and applications. All the gathered data is located to a folder where malware is launched (usually Users\/Temp<\/strong><\/em>). Before sending to a command server, malware packs that data into a protected .zip archive. It brings the password among its code rows.<\/p>\n

\"BlackGuard
Folders with collected data<\/figcaption><\/figure>\n

List of web browsers attacked by BlackGuard<\/h3>\n\n\n\n\n\n\n
Chrome<\/td>\nOpera<\/td>\nFirefox<\/td>\nEdge<\/td>\nIridium<\/td>\n7Star<\/td>\n<\/tr>\n
CentBrowser<\/td>\nChedot<\/td>\nVivaldi<\/td>\nKometa<\/td>\nElements Browser<\/td>\nEpic Privacy Browser<\/td>\n<\/tr>\n
Sputnik<\/td>\nNichrome<\/td>\nK-Meleon<\/td>\nUran<\/td>\nliebao<\/td>\nCocCoc<\/td>\n<\/tr>\n
MapleStudio<\/td>\nBraveSoftware<\/td>\nChromodo<\/td>\nuCozMedia<\/td>\nQIPSurf<\/td>\nOrbitum<\/td>\n<\/tr>\n
Comodo<\/td>\nCoowon<\/td>\nAmigo<\/td>\nTorch<\/td>\nComodo<\/td>\n360Browser<\/td>\n<\/tr>\n<\/table>\n

Crypto wallets attacked by BlackGuard<\/h4>\n

Desktop applications<\/h5>\n\n\n\n\n
AtomicWallet<\/td>\nAtomicDEX<\/td>\nExodus<\/td>\nLitecoinCore<\/td>\nMonero<\/td>\nJaxx<\/td>\n<\/tr>\n
Zcash<\/td>\nBitcoinCore<\/td>\nDashCore<\/td>\nElectrum<\/td>\nEthereum<\/td>\nSolar<\/td>\n<\/tr>\n
Wassabi<\/td>\nTokenPocket<\/td>\nFrame<\/td>\nZap<\/td>\nBinance<\/td>\nCoinbase<\/td>\n<\/tr>\n<\/table>\n
Browser extensions<\/h5>\n\n\n\n\n\n\n
Binance<\/td>\nKEPLR<\/td>\ncoin98<\/td>\nMobox<\/td>\nMetamask<\/td>\nPhantom<\/td>\n<\/tr>\n
BitApp<\/td>\nStarcoin<\/td>\nSlope Wallet<\/td>\nFinnie<\/td>\nGuildwallet<\/td>\niconx<\/td>\n<\/tr>\n
Swash<\/td>\nCrocobit<\/td>\nXinPay<\/td>\nSollet<\/td>\nAuvitas wallet<\/td>\nMath wallet<\/td>\n<\/tr>\n
Yoroi wallet<\/td>\nRonin wallet<\/td>\nMTV wallet<\/td>\nRabet wallet<\/td>\nZilPay wallet<\/td>\nTerra Station<\/td>\n<\/tr>\n
Nifty<\/td>\nJaxx<\/td>\nLiquality<\/td>\nMath10<\/td>\nExodus<\/td>\nOXYGEN<\/td>\n<\/tr>\n<\/table>\n

Other application<\/h4>\n

Additionally, BlackGuard is capable of collecting credentials from a row of VPN clients and FTP\/SFTP utilities<\/strong>, desktop messenger apps, and Microsoft Outlook. Particularly, it grabs credentials from configuration files of NordVPN, OpenVPN and ProtonVPN<\/strong>. Steam and Discord are hacked in a similar manner, while Tox, Signal, Pidgin, Telegram and Element<\/strong> are getting all the conversation collected.<\/p>\n

How to protect yourself?<\/h2>\n

There is only one consistent spreading method used by threat actors<\/strong> who operate BlackGuard \u2013 email spam. The latter, however, will likely have a form of spear phishing<\/a>, that tries to resemble genuine mailing or even messages that its victim is waiting for. Most of the time, crooks gather information using OSINT<\/a> about their victims for some time before sending messages.<\/p>\n

The exact message contains an attached file, commonly an MS Office document<\/a>. However, any file that can carry executable contents may be used. Office files gained popularity as VBS macro scripts<\/a> they can carry is ignored by the vast majority of anti-malware software. Launching the file makes the script run: it contacts the command server, downloads the payload, and runs it. This obscenely simple scheme was disrupted by the introduction of Mark-of-the-Web<\/strong>. Using the latter, Microsoft marks potentially risky files, calling additional attention to anti-malware programs. Still, that feature is present only in the latest Windows versions, and as it usually happens, users do not haste to install it.<\/p>\n

Another piece of advice to follow is to use anti-malware programs<\/strong>. Hackers do their best to make you believe the spam email or banner online. For that reason, it is better to exclude the human factor by using an automated solution that will not be fooled. But to be sure that such a sneaky thing as BlackGuard will not slip through, it is important for the security tool to have multi-layer protection. GridinSoft Anti-Malware can offer this to you<\/strong> \u2013 the program features a \u201cclassic\u201d database-backed scanning, as well as a heuristic engine and AI-based detection system<\/a>. All of them together create a reliable shield even against the most modern \u2013 and potent \u2013 threats.<\/p>\n

\"BlackGuard<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

BlackGuard, a prolific infostealer malware, received an update at the edge of 2023. The new update introduced advanced data-stealing capabilities and secure connectivity features. The new version also includes a row of new anti-detection and anti-analysis capabilities. Let\u2019s have a more detailed look into this malware and see the difference from all aspects. BlackGuard Stealer […]<\/p>\n","protected":false},"author":7,"featured_media":13934,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","footnotes":""},"categories":[15,17],"tags":[788,28,670],"class_list":{"0":"post-13912","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security-news","8":"category-labs","9":"tag-cybercrime","10":"tag-malware","11":"tag-threats"},"featured_image_src":"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2023\/03\/GS_Blog_banner_BlackGuard-Receives-New-Functions-In-The-Update_1280x674.webp","author_info":{"display_name":"Stephanie Adlam","author_link":"https:\/\/gridinsoft.com\/blogs\/author\/adlam\/"},"_links":{"self":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/13912","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/comments?post=13912"}],"version-history":[{"count":20,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/13912\/revisions"}],"predecessor-version":[{"id":14155,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/13912\/revisions\/14155"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media\/13934"}],"wp:attachment":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media?parent=13912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/categories?post=13912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/tags?post=13912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}