Overview

overview

10

Static

static

3

Habbo.exe

windows7-x64

10

Habbo.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8990b3b09dacf7b41a22dde9a531822f

  • Size

    416KB

  • Sample

    250203-rx4abatmey

  • MD5

    8990b3b09dacf7b41a22dde9a531822f

  • SHA1

    d78b6478d78673324ea9def4791d3690e83cafc7

  • SHA256

    a264482ef5b2a9e00a1a49b16d2762f0bc002a8f6d3529aa71c99b3d5a7a1daf

  • SHA512

    be2914c4465ef98d39dd61ddd806ebbdf5ea942f369a2be082b416437e2da272086818b38f408dd53298ce05a8f76408244c11126842019b2b76d7303e915796

  • SSDEEP

    6144:ISsvNUxleKQWXYG5h0CASrrWETXo5MEZgleEQcZucl2yj6bcz7g0IfuqCE58MIkN:zY61t5KCPmEsJZgltjRIBVz7bPYW4+F

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      Habbo.exe

    • Size

      763KB

    • MD5

      95ad8c8a032f860412892d00544d946c

    • SHA1

      71c4d57320319a15599f35ca68114da528797e4a

    • SHA256

      287683627f60823707063366331af376d6e70cffabcb307948ca84fa27aad8cf

    • SHA512

      7ce3eec2d0e636ba2bbaaa5b58cba8131f675ba2eeeab4cbc7c564350762e3e36e963a0c524a07d362ed8b8cbb46be523b71de0172fe7dcf326ef149c45e0ac0

    • SSDEEP

      12288:HacRRQp/b/2i0MnfS+JLFR+U1NErVIlZ51HoRqAD+iaX/1Hp2n73bfbbCz1HAZSM:HDo2DaD+gfpoxWP2KdYP/afGY

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks