General

  • Target

    521e563459a6fa96c021eac98dbecc156df7e16a9d53ff864ab8937769bedc93N.exe

  • Size

    1.7MB

  • Sample

    250125-bjfzvsxpfw

  • MD5

    9ae0769acf31b8814dcacf8b356c5b30

  • SHA1

    8891f2ca9fdf695518c2bbac2278863e282e3ad4

  • SHA256

    521e563459a6fa96c021eac98dbecc156df7e16a9d53ff864ab8937769bedc93

  • SHA512

    e00e2b6386485462b67715d60efea58bbd7ab5ed073b9c45217c69ce27b6f108ca5aa57326d2455d40e36e9e7fbe5dd75b3a3940893fca5213ca098fdcdce46b

  • SSDEEP

    12288:DZISeMFVhdL1XBvXxzGNABnwHdxkn7L1GzR1FYoxkM2N4JHUcTwoS+:VIW0rXi1GzRQo08l

Malware Config

Targets

    • Target

      521e563459a6fa96c021eac98dbecc156df7e16a9d53ff864ab8937769bedc93N.exe

    • Size

      1.7MB

    • MD5

      9ae0769acf31b8814dcacf8b356c5b30

    • SHA1

      8891f2ca9fdf695518c2bbac2278863e282e3ad4

    • SHA256

      521e563459a6fa96c021eac98dbecc156df7e16a9d53ff864ab8937769bedc93

    • SHA512

      e00e2b6386485462b67715d60efea58bbd7ab5ed073b9c45217c69ce27b6f108ca5aa57326d2455d40e36e9e7fbe5dd75b3a3940893fca5213ca098fdcdce46b

    • SSDEEP

      12288:DZISeMFVhdL1XBvXxzGNABnwHdxkn7L1GzR1FYoxkM2N4JHUcTwoS+:VIW0rXi1GzRQo08l

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks