blackshades | 15b1dafe92e9d0faa7a24fe026c90f4e82be3ce25bb4ec700b53691d11957809 | Triage

Sharing

General

Target

15b1dafe92e9d0faa7a24fe026c90f4e82be3ce25bb4ec700b53691d11957809N.exe
Size

448KB
Sample

250202-d2aa5stkdt
MD5

2c67929a7a3929359c94deeef4da7710
SHA1

363a86441fc390aec34d19debb57b772a71f8e21
SHA256

15b1dafe92e9d0faa7a24fe026c90f4e82be3ce25bb4ec700b53691d11957809
SHA512

c2ae914fb5bff91af78e2c3b3b32a2d5c8b40c1de2fc2c221341c9d74d9e007bf0dee3794af4290c9944ab50ee61dfd852e94e881d7e9df1d3b4f94ed35a2cc5
SSDEEP

6144:Th5IjKmFs4Hb4I2HIEi+nPHawdn0/JRSerTWIdeFjkZM6jI7F1eZ9A3m:t5IjKCsC4IsKRFqIQFjkZM6jI7TeZx

Score

10^/10

blackshades defense_evasion discovery persistence

Malware Config

Targets

- Target
  
  15b1dafe92e9d0faa7a24fe026c90f4e82be3ce25bb4ec700b53691d11957809N.exe
- Size
  
  448KB
- MD5
  
  2c67929a7a3929359c94deeef4da7710
- SHA1
  
  363a86441fc390aec34d19debb57b772a71f8e21
- SHA256
  
  15b1dafe92e9d0faa7a24fe026c90f4e82be3ce25bb4ec700b53691d11957809
- SHA512
  
  c2ae914fb5bff91af78e2c3b3b32a2d5c8b40c1de2fc2c221341c9d74d9e007bf0dee3794af4290c9944ab50ee61dfd852e94e881d7e9df1d3b4f94ed35a2cc5
- SSDEEP
  
  6144:Th5IjKmFs4Hb4I2HIEi+nPHawdn0/JRSerTWIdeFjkZM6jI7F1eZ9A3m:t5IjKCsC4IsKRFqIQFjkZM6jI7TeZx
Score

10^/10

defense_evasion discovery persistence
- Modifies firewall policy service
  defense_evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence