Overview

overview

10

Static

static

3

JaffaCakes...1f.exe

windows7-x64

10

JaffaCakes...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7fbf273208d42d925889034dbfef491f

  • Size

    369KB

  • Sample

    250202-xesczswqbq

  • MD5

    7fbf273208d42d925889034dbfef491f

  • SHA1

    7e08967de100f5d5694a64dc792239321de1a334

  • SHA256

    449bcf68eba9ca4f724751cb5ca0b9d4ccaf6e69dc385f66923bcc91b7acc4b7

  • SHA512

    27e5330f59b58b140107970011d850a85dc6a2f7fff5928b683adef657a163b805a33ee4ec562ce16cdcdcd3eeb00939b1ca0f2676aeaf7a82008eaacb721da6

  • SSDEEP

    6144:VLdlUscnMAKSnQXIlF9IZluXAYmU9xpwdaKKclGOo1oHjG+rNZa2gBIMXLgEn:VLdlCMjSnbl/IZlw59TmO9ma+rTA2Ms8

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_7fbf273208d42d925889034dbfef491f

    • Size

      369KB

    • MD5

      7fbf273208d42d925889034dbfef491f

    • SHA1

      7e08967de100f5d5694a64dc792239321de1a334

    • SHA256

      449bcf68eba9ca4f724751cb5ca0b9d4ccaf6e69dc385f66923bcc91b7acc4b7

    • SHA512

      27e5330f59b58b140107970011d850a85dc6a2f7fff5928b683adef657a163b805a33ee4ec562ce16cdcdcd3eeb00939b1ca0f2676aeaf7a82008eaacb721da6

    • SSDEEP

      6144:VLdlUscnMAKSnQXIlF9IZluXAYmU9xpwdaKKclGOo1oHjG+rNZa2gBIMXLgEn:VLdlCMjSnbl/IZlw59TmO9ma+rTA2Ms8

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistenceratupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks