General

  • Target

    689cb5d3fd39fd19c7153bd342dc3c8c5a7df0d18fb6dabaf4b098b10204fe5d.exe

  • Size

    2.0MB

  • Sample

    250124-wkajpaskap

  • MD5

    6c7d4839c61b087f29cf63a1e4fb42ea

  • SHA1

    d6b19a0280cb5c54f14e34750c5f1b8bea61e02d

  • SHA256

    689cb5d3fd39fd19c7153bd342dc3c8c5a7df0d18fb6dabaf4b098b10204fe5d

  • SHA512

    465df0035d4bd60601bc5ec6a74bde4d0454a171ff43853d1bd2685177200dff1182d7f6916c82c2944cee73e991200fb2b665def7f896524ba3eeb56bc25c03

  • SSDEEP

    49152:fmTWr53HxurntpSJU2mN2xl42d91cKSd5W6l/p7AFWVBpG947fVr0YfwCCkB1mpN:fmTWr53HxurntpSJU2mN2xu2d91cKSdo

Malware Config

Targets

    • Target

      689cb5d3fd39fd19c7153bd342dc3c8c5a7df0d18fb6dabaf4b098b10204fe5d.exe

    • Size

      2.0MB

    • MD5

      6c7d4839c61b087f29cf63a1e4fb42ea

    • SHA1

      d6b19a0280cb5c54f14e34750c5f1b8bea61e02d

    • SHA256

      689cb5d3fd39fd19c7153bd342dc3c8c5a7df0d18fb6dabaf4b098b10204fe5d

    • SHA512

      465df0035d4bd60601bc5ec6a74bde4d0454a171ff43853d1bd2685177200dff1182d7f6916c82c2944cee73e991200fb2b665def7f896524ba3eeb56bc25c03

    • SSDEEP

      49152:fmTWr53HxurntpSJU2mN2xl42d91cKSd5W6l/p7AFWVBpG947fVr0YfwCCkB1mpN:fmTWr53HxurntpSJU2mN2xu2d91cKSdo

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks