General

  • Target

    9ad7d0a0d52dff629082ee082219d422583abfec630d266513f1c5a419080965.exe

  • Size

    1.7MB

  • Sample

    250122-vt2tvsxncp

  • MD5

    4dc212141fda6a40ebe61f3c35aed5b9

  • SHA1

    40241b1a1fbb3ccdc0a20f02f49ed7c169acf953

  • SHA256

    9ad7d0a0d52dff629082ee082219d422583abfec630d266513f1c5a419080965

  • SHA512

    4597d6ef1cf65e59e3be60ee1c0f638c597a54f55e731defec62f2d03add39c9fd0592b704e6a7edb4bdc0486e90f80a53e9877c554bb4b7622cbcf6c92ab7fe

  • SSDEEP

    12288:DZISeMFVhdL1XBvXxzGNABnwHdxkn7L1GzR1FYoxkM2N4JHUcTwoSj:VIW0rXi1GzRQo08y

Malware Config

Targets

    • Target

      9ad7d0a0d52dff629082ee082219d422583abfec630d266513f1c5a419080965.exe

    • Size

      1.7MB

    • MD5

      4dc212141fda6a40ebe61f3c35aed5b9

    • SHA1

      40241b1a1fbb3ccdc0a20f02f49ed7c169acf953

    • SHA256

      9ad7d0a0d52dff629082ee082219d422583abfec630d266513f1c5a419080965

    • SHA512

      4597d6ef1cf65e59e3be60ee1c0f638c597a54f55e731defec62f2d03add39c9fd0592b704e6a7edb4bdc0486e90f80a53e9877c554bb4b7622cbcf6c92ab7fe

    • SSDEEP

      12288:DZISeMFVhdL1XBvXxzGNABnwHdxkn7L1GzR1FYoxkM2N4JHUcTwoSj:VIW0rXi1GzRQo08y

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks