General

  • Target

    5e1ce240f5bd3a9190a525cd64065df31fdfb9dcc2349746e800e8f03db21049.exe

  • Size

    2.0MB

  • Sample

    250125-dwl3ratjey

  • MD5

    d085e2c9037dac3abda555d1a66452a2

  • SHA1

    01c818d6749c4bce2336c8cb3840da3b6b109bf5

  • SHA256

    5e1ce240f5bd3a9190a525cd64065df31fdfb9dcc2349746e800e8f03db21049

  • SHA512

    af36f9b52349723010cb8f5fa8bd849aeee5c5768b778876c6939057df4623edc6a63813dd494b48ad2e040d429722f50e8b8b4a5b227379602eff2de5f6ae23

  • SSDEEP

    49152:imTWr53HxurntpSJU2mN2xl42d91cKSd5W6l/p7AFWVBpG947fVr0YfwCCkB1mpN:imTWr53HxurntpSJU2mN2xu2d91cKSdO

Malware Config

Targets

    • Target

      5e1ce240f5bd3a9190a525cd64065df31fdfb9dcc2349746e800e8f03db21049.exe

    • Size

      2.0MB

    • MD5

      d085e2c9037dac3abda555d1a66452a2

    • SHA1

      01c818d6749c4bce2336c8cb3840da3b6b109bf5

    • SHA256

      5e1ce240f5bd3a9190a525cd64065df31fdfb9dcc2349746e800e8f03db21049

    • SHA512

      af36f9b52349723010cb8f5fa8bd849aeee5c5768b778876c6939057df4623edc6a63813dd494b48ad2e040d429722f50e8b8b4a5b227379602eff2de5f6ae23

    • SSDEEP

      49152:imTWr53HxurntpSJU2mN2xl42d91cKSd5W6l/p7AFWVBpG947fVr0YfwCCkB1mpN:imTWr53HxurntpSJU2mN2xu2d91cKSdO

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks