Overview

overview

10

Static

static

3

JaffaCakes...6e.exe

windows7-x64

10

JaffaCakes...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5a1dd92b9a49a42c3512585900209f6e

  • Size

    665KB

  • Sample

    250129-xaw6davmfm

  • MD5

    5a1dd92b9a49a42c3512585900209f6e

  • SHA1

    069ab8362785c2c05409f7329c7868d565140482

  • SHA256

    39b57cec84e2147062c0ce1587177c3148ea3a378b5de0ee2126f6fb3c5547a0

  • SHA512

    145f28f1e8b0b74ec18a465e6f9c286b5c7d08ca1b235f81f4451a44b262b3eeefafba49b81253017d9322df04e36813900f7c186c2fdd2ce99b4e0df79c8df1

  • SSDEEP

    6144:9kSWzbB4OWs8IOybtD0SPnSUI4zjj2IaMfe6MPgyl:9kpzqOR88btgWS3Sucqgy

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_5a1dd92b9a49a42c3512585900209f6e

    • Size

      665KB

    • MD5

      5a1dd92b9a49a42c3512585900209f6e

    • SHA1

      069ab8362785c2c05409f7329c7868d565140482

    • SHA256

      39b57cec84e2147062c0ce1587177c3148ea3a378b5de0ee2126f6fb3c5547a0

    • SHA512

      145f28f1e8b0b74ec18a465e6f9c286b5c7d08ca1b235f81f4451a44b262b3eeefafba49b81253017d9322df04e36813900f7c186c2fdd2ce99b4e0df79c8df1

    • SSDEEP

      6144:9kSWzbB4OWs8IOybtD0SPnSUI4zjj2IaMfe6MPgyl:9kpzqOR88btgWS3Sucqgy

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistenceratupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks