General

  • Target

    45e2007f242c352045ac35943a2c54f1e13cb63d943f396741a04d69b5d6ff6cN.exe

  • Size

    1.2MB

  • Sample

    250124-z35dkaypcs

  • MD5

    e677ceb3a91449a7458d05fa339677e0

  • SHA1

    a23d4ef0cadad4fdfdc8c299674049f631442c07

  • SHA256

    45e2007f242c352045ac35943a2c54f1e13cb63d943f396741a04d69b5d6ff6c

  • SHA512

    b968b4d15baf53c234a8e14730db6472799125d355610eb48fd24aff8ad73fee7435ab21ba042451532b894d2d43509a09806db42767e1abee82a0247cb7aa3f

  • SSDEEP

    3072:gRRHyoBg8zJRAxuU+N6ET/d9ArfCS3VT62FQwiDefNbaSBVpMQRQ8imgCQIqi/cX:gRhoxrn/vmrqaTh2uMnuPea4g/Gch

Malware Config

Targets

    • Target

      45e2007f242c352045ac35943a2c54f1e13cb63d943f396741a04d69b5d6ff6cN.exe

    • Size

      1.2MB

    • MD5

      e677ceb3a91449a7458d05fa339677e0

    • SHA1

      a23d4ef0cadad4fdfdc8c299674049f631442c07

    • SHA256

      45e2007f242c352045ac35943a2c54f1e13cb63d943f396741a04d69b5d6ff6c

    • SHA512

      b968b4d15baf53c234a8e14730db6472799125d355610eb48fd24aff8ad73fee7435ab21ba042451532b894d2d43509a09806db42767e1abee82a0247cb7aa3f

    • SSDEEP

      3072:gRRHyoBg8zJRAxuU+N6ET/d9ArfCS3VT62FQwiDefNbaSBVpMQRQ8imgCQIqi/cX:gRhoxrn/vmrqaTh2uMnuPea4g/Gch

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks