Overview

overview

10

Static

static

3

ImageSet.‮rar.exe

windows7-x64

10

ImageSet.‮rar.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_657dc8618bc022d0ad456344079dff5b

  • Size

    1.8MB

  • Sample

    250130-w96y7a1ner

  • MD5

    657dc8618bc022d0ad456344079dff5b

  • SHA1

    0ded90245e5384182739221253a66d78ae1a61be

  • SHA256

    46a846510e46db4e5ffba9c5446a49b9180b1882daf22b36a7ba5f19d69ec786

  • SHA512

    83188158e6afed4ab622bc88cbbcb1d6cc8b5d8e096bc7ecd4ddace4b6010f11676bcf97e5e28642abea42dac9358982b3094749ee333fe5e785111e085a6559

  • SSDEEP

    49152:CrHAWbEpcl/TABb0QoseDwBqeR/sSzZ5AUV56a0WadL8t:CzAWbY+/TABwQosVBqe55Z5A83Nadw

Score
10/10
blackshadesdefense_evasiondiscoveryrat

Malware Config

Targets

    • Target

      ImageSet.‮rar.exe

    • Size

      3.9MB

    • MD5

      8b29c8e0c54701385c7ab1dd271cf2fd

    • SHA1

      ce2d93e7aeba8b51f2f0588ad88b4df7f6c72e92

    • SHA256

      6cedc49e0f8f8db512d9b6083c9bbe1111b923407d549950b18c199d77844d6c

    • SHA512

      c4e7ae6cef11622b6a4ace291dd5d1cfbbd257cd2491a98507575d273a35c29f504644d80899b78d1436f521d34da7ab05414abaf29ad6e17ce759314ce12f19

    • SSDEEP

      49152:yP8AfXrXjya0Ft1LlhToBbAWGseTwX0eNtOSnZTA4ZDwK082dX6:08evyT3hToB0WGszX0ejjZTAWjp2d

    Score
    10/10
    blackshadesdefense_evasiondiscoveryrat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks