General

  • Target

    JaffaCakes118_4a31febcee2a69b0ae55b386e83e09f7

  • Size

    334KB

  • Sample

    250128-m7zmnazkfr

  • MD5

    4a31febcee2a69b0ae55b386e83e09f7

  • SHA1

    a2b8e384dd383628484d9aaa2a69284838b37807

  • SHA256

    87a20804672bae566963ca60bbfa77bbfca1359781a43a8fac6c1991460fa432

  • SHA512

    30cb80bba8a7ed86dca55b7e5d41db105446aaedbd5bdeca71660ca9716d9046f3410fae0cca35d5cebb7d9917c63871e4513dbe5a3526e10d578b4af8eef007

  • SSDEEP

    6144:PTwww0JwwgSnvYqm9nxLW0Bs/kSTiOWGr97uZK7M73CThVrU4gmxKCN+7Awwwwwb:P63ay/tKjjbQ5qj+BIs

Malware Config

Targets

    • Target

      JaffaCakes118_4a31febcee2a69b0ae55b386e83e09f7

    • Size

      334KB

    • MD5

      4a31febcee2a69b0ae55b386e83e09f7

    • SHA1

      a2b8e384dd383628484d9aaa2a69284838b37807

    • SHA256

      87a20804672bae566963ca60bbfa77bbfca1359781a43a8fac6c1991460fa432

    • SHA512

      30cb80bba8a7ed86dca55b7e5d41db105446aaedbd5bdeca71660ca9716d9046f3410fae0cca35d5cebb7d9917c63871e4513dbe5a3526e10d578b4af8eef007

    • SSDEEP

      6144:PTwww0JwwgSnvYqm9nxLW0Bs/kSTiOWGr97uZK7M73CThVrU4gmxKCN+7Awwwwwb:P63ay/tKjjbQ5qj+BIs

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks