General

  • Target

    514d0b116481bffc87d860dcce2a014385d08e1a86b533ccb89b631af3c5ebe4.exe

  • Size

    2.0MB

  • Sample

    250122-ye16kasrcj

  • MD5

    b049f94bbd882e672ae3292e1b1e1327

  • SHA1

    d56db2cdeab0b71df5ea44500ddeedc833915bf7

  • SHA256

    514d0b116481bffc87d860dcce2a014385d08e1a86b533ccb89b631af3c5ebe4

  • SHA512

    f4f044ea116d44ebd22b2c0348954cc7651c41afc2a9d1058eca9f86e85005ea6811a9cf7783cc590abb646bffbdf408f435f8c6048c8e389789228885172e73

  • SSDEEP

    49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWm:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aad

Malware Config

Targets

    • Target

      514d0b116481bffc87d860dcce2a014385d08e1a86b533ccb89b631af3c5ebe4.exe

    • Size

      2.0MB

    • MD5

      b049f94bbd882e672ae3292e1b1e1327

    • SHA1

      d56db2cdeab0b71df5ea44500ddeedc833915bf7

    • SHA256

      514d0b116481bffc87d860dcce2a014385d08e1a86b533ccb89b631af3c5ebe4

    • SHA512

      f4f044ea116d44ebd22b2c0348954cc7651c41afc2a9d1058eca9f86e85005ea6811a9cf7783cc590abb646bffbdf408f435f8c6048c8e389789228885172e73

    • SSDEEP

      49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWm:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aad

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks