General

  • Target

    dee3a94c1787ec8ebc5deb9058cca3a761fb571f359f1493e887d2957e359ac2.exe

  • Size

    2.4MB

  • Sample

    250125-hlt3ts1kgy

  • MD5

    b207ff5992462326a197daeba280d4dd

  • SHA1

    0c3805d2adde74cd1a3c39c8c13a941ee21a1be2

  • SHA256

    dee3a94c1787ec8ebc5deb9058cca3a761fb571f359f1493e887d2957e359ac2

  • SHA512

    6b9c16af54b3f2f611b000e92235ab3d02d63b25018416b19f2cbbc5b4b2c5f8c529adc4f9c0c5b59158e623cfd1f83a79dbc5c6fce177d1f049a23834237181

  • SSDEEP

    49152:2Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+67:f+zhGqx3WeSkKkAQOQ1y7PlXRYxxTttd

Malware Config

Targets

    • Target

      dee3a94c1787ec8ebc5deb9058cca3a761fb571f359f1493e887d2957e359ac2.exe

    • Size

      2.4MB

    • MD5

      b207ff5992462326a197daeba280d4dd

    • SHA1

      0c3805d2adde74cd1a3c39c8c13a941ee21a1be2

    • SHA256

      dee3a94c1787ec8ebc5deb9058cca3a761fb571f359f1493e887d2957e359ac2

    • SHA512

      6b9c16af54b3f2f611b000e92235ab3d02d63b25018416b19f2cbbc5b4b2c5f8c529adc4f9c0c5b59158e623cfd1f83a79dbc5c6fce177d1f049a23834237181

    • SSDEEP

      49152:2Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+67:f+zhGqx3WeSkKkAQOQ1y7PlXRYxxTttd

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks