General

  • Target

    da90e223e00a483c1d111a6a17743c9ac81f1177b0f6617abdf511f9e96033f5N.exe

  • Size

    1.8MB

  • Sample

    250124-3apzystncw

  • MD5

    0789fb0af387e914a3fe25cbdd2d8e70

  • SHA1

    4e2bbca85752e3600b0de3085b45b8d8bea612e1

  • SHA256

    da90e223e00a483c1d111a6a17743c9ac81f1177b0f6617abdf511f9e96033f5

  • SHA512

    c574d0b462968510cb563b6c57a3bbc7459e7aff09bc7ae8ea2d42ec9adeac319b80c3fbf7129f3b974e17d51809496e8da6e6d0e515b33ae5a40b50a45ef4fc

  • SSDEEP

    12288:BHTVhI8jdG+sV1p0x/k9fkQ3KypwkBPKxY9XZdFh29DNDupLdXUoWxOT8oSy:tV35QOk3KWNo34nOOTx

Malware Config

Targets

    • Target

      da90e223e00a483c1d111a6a17743c9ac81f1177b0f6617abdf511f9e96033f5N.exe

    • Size

      1.8MB

    • MD5

      0789fb0af387e914a3fe25cbdd2d8e70

    • SHA1

      4e2bbca85752e3600b0de3085b45b8d8bea612e1

    • SHA256

      da90e223e00a483c1d111a6a17743c9ac81f1177b0f6617abdf511f9e96033f5

    • SHA512

      c574d0b462968510cb563b6c57a3bbc7459e7aff09bc7ae8ea2d42ec9adeac319b80c3fbf7129f3b974e17d51809496e8da6e6d0e515b33ae5a40b50a45ef4fc

    • SSDEEP

      12288:BHTVhI8jdG+sV1p0x/k9fkQ3KypwkBPKxY9XZdFh29DNDupLdXUoWxOT8oSy:tV35QOk3KWNo34nOOTx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks