Overview

overview

10

Static

static

3

Fraps.exe

windows7-x64

10

Fraps.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_70e1de1f18b547b47055cb569fc68e5d

  • Size

    434KB

  • Sample

    250201-mv2aqa1jdk

  • MD5

    70e1de1f18b547b47055cb569fc68e5d

  • SHA1

    6c89db6d6049447276bbaf182d381df0f4aff72d

  • SHA256

    317fbe6431821d80d6b185315265a65191b54d8594ba47635d187bc6b31ad4c1

  • SHA512

    ba4391d74b4fb144e80c1f0b335f21e657d1eb2019273fe05ef011c85e9d46601a2509e4b20b5555c9b69f6584fa7247864997c3746b331d045ecb0c8e6c7f0b

  • SSDEEP

    12288:GpwsNON9nbHV/hq1TEeiqXTsUgoWT+ozb/K5IOLj:GpLK9b1Z0TlHXgNoA1bC53n

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      Fraps.exe

    • Size

      614KB

    • MD5

      85d15519bbeb7b0d32de6154f50fa648

    • SHA1

      bcaf17971e4856d86cd50e37c372b1f95bfdd905

    • SHA256

      985b1ca9ccd32331f1ccfb3d9686bb8dd1756b4a8e28c0b653c2a21e56629575

    • SHA512

      acbf3ef4bc60aebfcd755aca093376969eef8cad4267a72dc5bb21c67c658d4c98543293f196053bbc8a960052dc9b9e70a3abf647670b5ad827376a023bc78b

    • SSDEEP

      12288:ZorB1UtNK6KrLe5wbgfygyTSqALSV2TPjWoMWwv2Ui4l26L6OGxV3rY:ZkB1UOe5/UNi+6KoK26qlY

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks