General

  • Target

    JaffaCakes118_63bc292efdfd2a38198c438a413ac023

  • Size

    174KB

  • Sample

    250130-rv7jystmgt

  • MD5

    63bc292efdfd2a38198c438a413ac023

  • SHA1

    3887d692c1c070f3a45a35e10c29325b2c3283b6

  • SHA256

    5cdf20ea2b7defc40b573d8bf3fceda211d6f7e7d97cefd26f3ac210cbddb8af

  • SHA512

    75214d506bacbf1bbea6470efe4ce3ba69e24de757c563747a19209c898c0e92590f00934dd0ff1815e827f800b7351494ecf3e9d69bec9ac70c12fa9bb44daa

  • SSDEEP

    3072:YEjVHeXUTN4Ns1vJxrOL60AD85h3/Cz+ZYyXGdoyQdFKj3kCTN9SJC0ekT:YEjVLTONWJxrOLw85Z/7lDUjNj70ew

Malware Config

Extracted

Family

latentbot

C2

sephiroth99.zapto.org

1sephiroth99.zapto.org

2sephiroth99.zapto.org

3sephiroth99.zapto.org

4sephiroth99.zapto.org

5sephiroth99.zapto.org

6sephiroth99.zapto.org

7sephiroth99.zapto.org

8sephiroth99.zapto.org

Targets

    • Target

      JaffaCakes118_63bc292efdfd2a38198c438a413ac023

    • Size

      174KB

    • MD5

      63bc292efdfd2a38198c438a413ac023

    • SHA1

      3887d692c1c070f3a45a35e10c29325b2c3283b6

    • SHA256

      5cdf20ea2b7defc40b573d8bf3fceda211d6f7e7d97cefd26f3ac210cbddb8af

    • SHA512

      75214d506bacbf1bbea6470efe4ce3ba69e24de757c563747a19209c898c0e92590f00934dd0ff1815e827f800b7351494ecf3e9d69bec9ac70c12fa9bb44daa

    • SSDEEP

      3072:YEjVHeXUTN4Ns1vJxrOL60AD85h3/Cz+ZYyXGdoyQdFKj3kCTN9SJC0ekT:YEjVLTONWJxrOLw85Z/7lDUjNj70ew

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Latentbot family

    • Modifies firewall policy service

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks