General

  • Target

    85cc81d18f5815ad231964425789a01759122bf86b3f4b8626d69fb217a872ccN.exe

  • Size

    2.0MB

  • Sample

    250125-f13bmsxpcy

  • MD5

    3636fe0e201917a910335ed4f9217320

  • SHA1

    962fcb6738a7dad851c50ad9038c3b40138e09cc

  • SHA256

    85cc81d18f5815ad231964425789a01759122bf86b3f4b8626d69fb217a872cc

  • SHA512

    db2251bdc709d723821fdc23dae9f33c81faec4142848046478ce006df586081fe4d551b422c935435a9104d99ae1c2c71010b678c54de53994b89bb455ec68f

  • SSDEEP

    49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWr:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aaq

Malware Config

Targets

    • Target

      85cc81d18f5815ad231964425789a01759122bf86b3f4b8626d69fb217a872ccN.exe

    • Size

      2.0MB

    • MD5

      3636fe0e201917a910335ed4f9217320

    • SHA1

      962fcb6738a7dad851c50ad9038c3b40138e09cc

    • SHA256

      85cc81d18f5815ad231964425789a01759122bf86b3f4b8626d69fb217a872cc

    • SHA512

      db2251bdc709d723821fdc23dae9f33c81faec4142848046478ce006df586081fe4d551b422c935435a9104d99ae1c2c71010b678c54de53994b89bb455ec68f

    • SSDEEP

      49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWr:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aaq

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks