General
-
Target
b0a89b866557e2547e00a9b27ff92cc1509a69375415383e48dd55534b3ddd65.exe
-
Size
676KB
-
Sample
250122-xqv81s1pdq
-
MD5
9b52d8a39f17ad9593b735b0a409650b
-
SHA1
679f5f278626f3fcdfaa21c4beffa4309c420891
-
SHA256
b0a89b866557e2547e00a9b27ff92cc1509a69375415383e48dd55534b3ddd65
-
SHA512
87cdf78d69e327a7677910e3ed45f9338a47b041143e8626cf6d92c9fa902d50aa4b1bfa600babf2746f599947e36575024eb0372af007dc8aebede8fd59d6d6
-
SSDEEP
12288:XmdQyIkTvh1zp9LLyMMqoatfKLtMk+KEwtMq9uyn5iJDFLaj+U:XmdQyIkTvh1rSVbatfCMrDi
Static task
static1
Behavioral task
behavioral1
Sample
b0a89b866557e2547e00a9b27ff92cc1509a69375415383e48dd55534b3ddd65.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b0a89b866557e2547e00a9b27ff92cc1509a69375415383e48dd55534b3ddd65.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
b0a89b866557e2547e00a9b27ff92cc1509a69375415383e48dd55534b3ddd65.exe
-
Size
676KB
-
MD5
9b52d8a39f17ad9593b735b0a409650b
-
SHA1
679f5f278626f3fcdfaa21c4beffa4309c420891
-
SHA256
b0a89b866557e2547e00a9b27ff92cc1509a69375415383e48dd55534b3ddd65
-
SHA512
87cdf78d69e327a7677910e3ed45f9338a47b041143e8626cf6d92c9fa902d50aa4b1bfa600babf2746f599947e36575024eb0372af007dc8aebede8fd59d6d6
-
SSDEEP
12288:XmdQyIkTvh1zp9LLyMMqoatfKLtMk+KEwtMq9uyn5iJDFLaj+U:XmdQyIkTvh1rSVbatfCMrDi
-
Blackshades family
-
Blackshades payload
-
Modifies firewall policy service
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3