General

  • Target

    JaffaCakes118_0d8821f209119d90653f599aba293bfc

  • Size

    80KB

  • Sample

    250122-pfbgvswrbj

  • MD5

    0d8821f209119d90653f599aba293bfc

  • SHA1

    c15826059265766e45a6d8d014d8bc4b68990b38

  • SHA256

    f61e261b31c1a5213b94abd40144228be02a6b74b0d932365205a96ac355d72c

  • SHA512

    1b40e0cb9c0fe54867c4322862bd98d4e7e7bb42048073320414372ba3912b05385449592b16fa4f36f5763e1baa62c774d9d128ab129151890145a7c5fc49cc

  • SSDEEP

    1536:uK9tLguzpq+1dssPUZJMUDtX5KmXCrNP17o:1guRssPURp3Crro

Malware Config

Targets

    • Target

      JaffaCakes118_0d8821f209119d90653f599aba293bfc

    • Size

      80KB

    • MD5

      0d8821f209119d90653f599aba293bfc

    • SHA1

      c15826059265766e45a6d8d014d8bc4b68990b38

    • SHA256

      f61e261b31c1a5213b94abd40144228be02a6b74b0d932365205a96ac355d72c

    • SHA512

      1b40e0cb9c0fe54867c4322862bd98d4e7e7bb42048073320414372ba3912b05385449592b16fa4f36f5763e1baa62c774d9d128ab129151890145a7c5fc49cc

    • SSDEEP

      1536:uK9tLguzpq+1dssPUZJMUDtX5KmXCrNP17o:1guRssPURp3Crro

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks