General

  • Target

    7e011502582108ebf1cadb258d1e2a4e41d4831a5133e7025f8a36481a60992dN.exe

  • Size

    2.0MB

  • Sample

    250125-jms3lavkek

  • MD5

    31ad44108cc4889666bbc11fd989f120

  • SHA1

    ae2ce1d844f24b8665211ea4020ef1d148819b79

  • SHA256

    7e011502582108ebf1cadb258d1e2a4e41d4831a5133e7025f8a36481a60992d

  • SHA512

    9481347cfdd1601b7e7cddbd853a297803a10caf27fc249b6c56aa2f7cd22b753a45096ef0169bb2754b041fa3b9e88333a4513229c1f356fef1d52c23e96fb9

  • SSDEEP

    49152:imTWr53HxurntpSJU2mN2xl42d91cKSd5W6l/p7AFWVBpG947fVr0YfwCCkB1mp/:imTWr53HxurntpSJU2mN2xu2d91cKSdK

Malware Config

Targets

    • Target

      7e011502582108ebf1cadb258d1e2a4e41d4831a5133e7025f8a36481a60992dN.exe

    • Size

      2.0MB

    • MD5

      31ad44108cc4889666bbc11fd989f120

    • SHA1

      ae2ce1d844f24b8665211ea4020ef1d148819b79

    • SHA256

      7e011502582108ebf1cadb258d1e2a4e41d4831a5133e7025f8a36481a60992d

    • SHA512

      9481347cfdd1601b7e7cddbd853a297803a10caf27fc249b6c56aa2f7cd22b753a45096ef0169bb2754b041fa3b9e88333a4513229c1f356fef1d52c23e96fb9

    • SSDEEP

      49152:imTWr53HxurntpSJU2mN2xl42d91cKSd5W6l/p7AFWVBpG947fVr0YfwCCkB1mp/:imTWr53HxurntpSJU2mN2xu2d91cKSdK

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks