Overview

overview

10

Static

static

3

JaffaCakes...5f.exe

windows7-x64

10

JaffaCakes...5f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_336f849730aec325573411a90b8c065f

  • Size

    761KB

  • Sample

    250126-hwh4bawrbk

  • MD5

    336f849730aec325573411a90b8c065f

  • SHA1

    2ef374efe156ba472814863e6202deba4a734371

  • SHA256

    44ba0e437f4cca0d290456a4a2c923484c3acb61c4f4a1bc9475830889b4aa93

  • SHA512

    6ef414ed7eab8ae4223bad47fec3dddb322390abc818412940714e8d652cc6d61a5b57edbb7eafc5335ccea49f903a438250816f1472a762f36d7dbea1b6cdbe

  • SSDEEP

    12288:Mwg5JnWdbxqAkk7WNm2ox2/26/VeqmuHdL1DunRXTP4MlAEv86ojwz:rqyhFl3rJYw

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_336f849730aec325573411a90b8c065f

    • Size

      761KB

    • MD5

      336f849730aec325573411a90b8c065f

    • SHA1

      2ef374efe156ba472814863e6202deba4a734371

    • SHA256

      44ba0e437f4cca0d290456a4a2c923484c3acb61c4f4a1bc9475830889b4aa93

    • SHA512

      6ef414ed7eab8ae4223bad47fec3dddb322390abc818412940714e8d652cc6d61a5b57edbb7eafc5335ccea49f903a438250816f1472a762f36d7dbea1b6cdbe

    • SSDEEP

      12288:Mwg5JnWdbxqAkk7WNm2ox2/26/VeqmuHdL1DunRXTP4MlAEv86ojwz:rqyhFl3rJYw

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks