Overview

overview

10

Static

static

3

JaffaCakes...1c.exe

windows7-x64

10

JaffaCakes...1c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7bac0c66a768035e8252dbbdc75abc1c

  • Size

    152KB

  • Sample

    250202-lzdjsaylfr

  • MD5

    7bac0c66a768035e8252dbbdc75abc1c

  • SHA1

    44b1fe75ad7768db6d83c9650429f3763baa0589

  • SHA256

    a2dc1cc71ab3f43dc29bbef7f42f0f2f38e398e3c94e7b1c7a341787c94a9994

  • SHA512

    011a3a180aa132d20ad0edb6adabb93359b02d8183cca25e1952282b998d9193c4e7d390c6fa258094eef342c5c80c073f11e09ad48d859b0d26d8e205d2e1d0

  • SSDEEP

    3072:NIBYVbNioJr6BackSchWF1RiKfLSZoXddeGwo2y92T:NbV1J++SchSRJSZoX3e5yG

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_7bac0c66a768035e8252dbbdc75abc1c

    • Size

      152KB

    • MD5

      7bac0c66a768035e8252dbbdc75abc1c

    • SHA1

      44b1fe75ad7768db6d83c9650429f3763baa0589

    • SHA256

      a2dc1cc71ab3f43dc29bbef7f42f0f2f38e398e3c94e7b1c7a341787c94a9994

    • SHA512

      011a3a180aa132d20ad0edb6adabb93359b02d8183cca25e1952282b998d9193c4e7d390c6fa258094eef342c5c80c073f11e09ad48d859b0d26d8e205d2e1d0

    • SSDEEP

      3072:NIBYVbNioJr6BackSchWF1RiKfLSZoXddeGwo2y92T:NbV1J++SchSRJSZoX3e5yG

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistenceratupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks