General

  • Target

    JaffaCakes118_223545bed1be9c7cf4e7ff251f5f32bc

  • Size

    635KB

  • Sample

    250124-rghzfasjd1

  • MD5

    223545bed1be9c7cf4e7ff251f5f32bc

  • SHA1

    68af6a6f0b3c7d86e42cb1f0dc255e913e900968

  • SHA256

    15ee04bc83b60d9d07e8446728e98fc21a4f4a5da33477524b896e2670c3e625

  • SHA512

    f0af8280e6be3448c1c9dba031c8727eac0400aac0d81c9e292229dad48f4a149275ba28a06f45120052bcea5896f02c8eccb7609180ec10a15ffc891d149232

  • SSDEEP

    12288:aBXoIbgUtLFvkTfwOFQnLOcJkyvBOW7tTwDj7/8wJIdqjELrqIh:UsjJFQLOkJvBx79wDnJJR6W8

Malware Config

Targets

    • Target

      JaffaCakes118_223545bed1be9c7cf4e7ff251f5f32bc

    • Size

      635KB

    • MD5

      223545bed1be9c7cf4e7ff251f5f32bc

    • SHA1

      68af6a6f0b3c7d86e42cb1f0dc255e913e900968

    • SHA256

      15ee04bc83b60d9d07e8446728e98fc21a4f4a5da33477524b896e2670c3e625

    • SHA512

      f0af8280e6be3448c1c9dba031c8727eac0400aac0d81c9e292229dad48f4a149275ba28a06f45120052bcea5896f02c8eccb7609180ec10a15ffc891d149232

    • SSDEEP

      12288:aBXoIbgUtLFvkTfwOFQnLOcJkyvBOW7tTwDj7/8wJIdqjELrqIh:UsjJFQLOkJvBx79wDnJJR6W8

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks