blackshades | 8bda2cddbe01436d927e7ec12c8b32d6023f7e10b65614f455dad00dcfc54b02 | Triage

Sharing

General

Target

8bda2cddbe01436d927e7ec12c8b32d6023f7e10b65614f455dad00dcfc54b02.exe
Size

520KB
Sample

250125-r6xtwsypaq
MD5

9dfb1918532af89cfb3f3d42731e80b3
SHA1

2de10c34c8fab5a35b571d0fb12f96512751bb54
SHA256

8bda2cddbe01436d927e7ec12c8b32d6023f7e10b65614f455dad00dcfc54b02
SHA512

ec83a69b847031d16cd007d73ec2044ed54ce7362af2986b8cc675ba2b014ef4edc669cbc3e9351f4a444cb68b1b1d84a8c9e5e337165686acf39b43fedef9c7
SSDEEP

12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioX5:zW6ncoyqOp6IsTl/mX5

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Targets

- Target
  
  8bda2cddbe01436d927e7ec12c8b32d6023f7e10b65614f455dad00dcfc54b02.exe
- Size
  
  520KB
- MD5
  
  9dfb1918532af89cfb3f3d42731e80b3
- SHA1
  
  2de10c34c8fab5a35b571d0fb12f96512751bb54
- SHA256
  
  8bda2cddbe01436d927e7ec12c8b32d6023f7e10b65614f455dad00dcfc54b02
- SHA512
  
  ec83a69b847031d16cd007d73ec2044ed54ce7362af2986b8cc675ba2b014ef4edc669cbc3e9351f4a444cb68b1b1d84a8c9e5e337165686acf39b43fedef9c7
- SSDEEP
  
  12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioX5:zW6ncoyqOp6IsTl/mX5
Score

10^/10

blackshades defense_evasion discovery persistence rat
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesdefense_evasiondiscoverypersistencerat

behavioral2

blackshadesdefense_evasiondiscoverypersistencerat