General
-
Target
JaffaCakes118_3ae9b6814b4e53dfb362d10b7af5a490
-
Size
499KB
-
Sample
250127-b9tzeawjdm
-
MD5
3ae9b6814b4e53dfb362d10b7af5a490
-
SHA1
585d5c4e2c624b906137b9ea47664b2dea5de2cf
-
SHA256
4f94ecfe1d596098b3d38e61bffc84331d21ce404007b61f561640a86773f4ed
-
SHA512
b6002661ae17d5228c8b9cf88ddeb1080ecfef0fe99c2297a827699118cbc853600fad743617c123502900d99c8be0b02d2d61116a01f0ebf9a598c1353e951e
-
SSDEEP
6144:R/SuZXvFCbIE63YF3bUqlA7U/ysk5ypO/LIGNIb8BgkRqW2bRjtlL4DQ8yZoM2Yv:xSQKF3bUqC4BkqOsGNc8B3RqxP8QLp
Malware Config
Targets
-
-
Target
JaffaCakes118_3ae9b6814b4e53dfb362d10b7af5a490
-
Size
499KB
-
MD5
3ae9b6814b4e53dfb362d10b7af5a490
-
SHA1
585d5c4e2c624b906137b9ea47664b2dea5de2cf
-
SHA256
4f94ecfe1d596098b3d38e61bffc84331d21ce404007b61f561640a86773f4ed
-
SHA512
b6002661ae17d5228c8b9cf88ddeb1080ecfef0fe99c2297a827699118cbc853600fad743617c123502900d99c8be0b02d2d61116a01f0ebf9a598c1353e951e
-
SSDEEP
6144:R/SuZXvFCbIE63YF3bUqlA7U/ysk5ypO/LIGNIb8BgkRqW2bRjtlL4DQ8yZoM2Yv:xSQKF3bUqC4BkqOsGNc8B3RqxP8QLp
Score10/10-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload
-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1