General
-
Target
JaffaCakes118_598ece767bbfcbb50fab930f73181328
-
Size
200KB
-
Sample
250129-v5yxcatkam
-
MD5
598ece767bbfcbb50fab930f73181328
-
SHA1
03855c129c067f1e6a9c3c988e55dbf2b564654b
-
SHA256
50bc7f06c3b0457a6d5d7429e4d7d9862bad985b03d29f71590d31519a773455
-
SHA512
c740679bc815b796f94f08c878e8b4aaa965a68d5fe8d608c97c420b9c39612b1bd42e596194504f67279e90478a40dbd19ceece699a7b5dc9ecd64c5187bb2b
-
SSDEEP
3072:+YVOmdfNQBihJt7rR5gq20ZM4CtBRKTTMGCPDb4EPt05nwiYsNkYzMqUMAiNIYqz:+K7BR9s0Z67bRl0ZTDNkYgq31Gz
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_598ece767bbfcbb50fab930f73181328.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_598ece767bbfcbb50fab930f73181328.exe
Resource
win10v2004-20250129-en
Malware Config
Targets
-
-
Target
JaffaCakes118_598ece767bbfcbb50fab930f73181328
-
Size
200KB
-
MD5
598ece767bbfcbb50fab930f73181328
-
SHA1
03855c129c067f1e6a9c3c988e55dbf2b564654b
-
SHA256
50bc7f06c3b0457a6d5d7429e4d7d9862bad985b03d29f71590d31519a773455
-
SHA512
c740679bc815b796f94f08c878e8b4aaa965a68d5fe8d608c97c420b9c39612b1bd42e596194504f67279e90478a40dbd19ceece699a7b5dc9ecd64c5187bb2b
-
SSDEEP
3072:+YVOmdfNQBihJt7rR5gq20ZM4CtBRKTTMGCPDb4EPt05nwiYsNkYzMqUMAiNIYqz:+K7BR9s0Z67bRl0ZTDNkYgq31Gz
-
Blackshades family
-
Blackshades payload
-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1