General

  • Target

    2583e800b8e93edac43090f692048cc9d0dba3555cd021e45b46850c75a22ec2N.exe

  • Size

    1.6MB

  • Sample

    250125-fvnajaypdj

  • MD5

    c216a146e1846d17f0c37045905eb040

  • SHA1

    c0a3460fdf5f6c75e9bbf00a28de794a8fa90493

  • SHA256

    2583e800b8e93edac43090f692048cc9d0dba3555cd021e45b46850c75a22ec2

  • SHA512

    7a11a8b9f8477fc16770e52340aa686c740d393c44e6c323c4a10c3b36fbab3da3dd902681afaf198673f5356759380a6b902b398e01b14be55a06627d69a199

  • SSDEEP

    12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYim:h1zltpu0im

Malware Config

Targets

    • Target

      2583e800b8e93edac43090f692048cc9d0dba3555cd021e45b46850c75a22ec2N.exe

    • Size

      1.6MB

    • MD5

      c216a146e1846d17f0c37045905eb040

    • SHA1

      c0a3460fdf5f6c75e9bbf00a28de794a8fa90493

    • SHA256

      2583e800b8e93edac43090f692048cc9d0dba3555cd021e45b46850c75a22ec2

    • SHA512

      7a11a8b9f8477fc16770e52340aa686c740d393c44e6c323c4a10c3b36fbab3da3dd902681afaf198673f5356759380a6b902b398e01b14be55a06627d69a199

    • SSDEEP

      12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYim:h1zltpu0im

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks