General

  • Target

    JaffaCakes118_790cc414d59d606495f9c942ab7f2d2d

  • Size

    888KB

  • Sample

    250202-e78assxmdm

  • MD5

    790cc414d59d606495f9c942ab7f2d2d

  • SHA1

    ebafafe5576bb96a59ead7168c44168e3e29f675

  • SHA256

    ae3b0ec48c6fe450677181f97d83fee2092d578c796012d9273721e3b19e3a32

  • SHA512

    7adb31700ad13d2fdb4f64e83a8fff278bc474021932a087a67756009d8c7ca8cc509672f656a973ccd99916ea67dc019ceec1cb743bccd1144856cf4fd7f68a

  • SSDEEP

    24576:Ybk6gx3bh5ISCIuTPCuVRdnlef5Ls3nNPFUySs8Ky:x3bh5ISCIuTPCuV3lAu9WzB

Malware Config

Targets

    • Target

      JaffaCakes118_790cc414d59d606495f9c942ab7f2d2d

    • Size

      888KB

    • MD5

      790cc414d59d606495f9c942ab7f2d2d

    • SHA1

      ebafafe5576bb96a59ead7168c44168e3e29f675

    • SHA256

      ae3b0ec48c6fe450677181f97d83fee2092d578c796012d9273721e3b19e3a32

    • SHA512

      7adb31700ad13d2fdb4f64e83a8fff278bc474021932a087a67756009d8c7ca8cc509672f656a973ccd99916ea67dc019ceec1cb743bccd1144856cf4fd7f68a

    • SSDEEP

      24576:Ybk6gx3bh5ISCIuTPCuVRdnlef5Ls3nNPFUySs8Ky:x3bh5ISCIuTPCuV3lAu9WzB

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Adds Run key to start application

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks