General

  • Target

    ce258447356dd617dc2d2977c7acefea6a7dd10c89e6bee4f1b02ef75d467c67

  • Size

    2.4MB

  • Sample

    250123-jdxdnazjft

  • MD5

    dd3eb9e8ac80b8def01d9aaedc296e72

  • SHA1

    cbbca7ded7929397ef53dc15b405a686e5495d47

  • SHA256

    ce258447356dd617dc2d2977c7acefea6a7dd10c89e6bee4f1b02ef75d467c67

  • SHA512

    3ca06bedd0240b305e26be203f14e70ebafe8169ebb488b1c47fd0f9471cca9f46349f76d799441fdacbf7644d3b76cbd71c71f9c0563104d99e687e9e03fa67

  • SSDEEP

    49152:5Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6c:I+zhGqx3WeSkKkAQOQ1y7PlXRYxxTttW

Malware Config

Targets

    • Target

      ce258447356dd617dc2d2977c7acefea6a7dd10c89e6bee4f1b02ef75d467c67

    • Size

      2.4MB

    • MD5

      dd3eb9e8ac80b8def01d9aaedc296e72

    • SHA1

      cbbca7ded7929397ef53dc15b405a686e5495d47

    • SHA256

      ce258447356dd617dc2d2977c7acefea6a7dd10c89e6bee4f1b02ef75d467c67

    • SHA512

      3ca06bedd0240b305e26be203f14e70ebafe8169ebb488b1c47fd0f9471cca9f46349f76d799441fdacbf7644d3b76cbd71c71f9c0563104d99e687e9e03fa67

    • SSDEEP

      49152:5Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6c:I+zhGqx3WeSkKkAQOQ1y7PlXRYxxTttW

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks