General

  • Target

    30af3a615a105f7fdadd0117f2602231d9737ff4838e01ffce1d9ffc6617c0aa.exe

  • Size

    1.6MB

  • Sample

    250121-ltzj3ayjbl

  • MD5

    e68233552400dfb86d67f38c95bfaa25

  • SHA1

    fbebffe93c4db36d8b0ffcdcc1227764df3f1a26

  • SHA256

    30af3a615a105f7fdadd0117f2602231d9737ff4838e01ffce1d9ffc6617c0aa

  • SHA512

    75225588ebe410380e0c6efea5b9ec08d15f956a6ecec1e61d4f7a92d2e0ac93e4d8f0afa7e8852a0470becf6b4bd033874c6c34cdd9f26890ba992a02bf3d51

  • SSDEEP

    12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYiY:h1zltpu0iY

Malware Config

Targets

    • Target

      30af3a615a105f7fdadd0117f2602231d9737ff4838e01ffce1d9ffc6617c0aa.exe

    • Size

      1.6MB

    • MD5

      e68233552400dfb86d67f38c95bfaa25

    • SHA1

      fbebffe93c4db36d8b0ffcdcc1227764df3f1a26

    • SHA256

      30af3a615a105f7fdadd0117f2602231d9737ff4838e01ffce1d9ffc6617c0aa

    • SHA512

      75225588ebe410380e0c6efea5b9ec08d15f956a6ecec1e61d4f7a92d2e0ac93e4d8f0afa7e8852a0470becf6b4bd033874c6c34cdd9f26890ba992a02bf3d51

    • SSDEEP

      12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYiY:h1zltpu0iY

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks