Overview

overview

10

Static

static

3

JaffaCakes...48.exe

windows7-x64

10

JaffaCakes...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8ca614e5a46a93622584fbef435ce048

  • Size

    512KB

  • Sample

    250203-z2fzkstlht

  • MD5

    8ca614e5a46a93622584fbef435ce048

  • SHA1

    363c300cb3ded18ebc148ab1a01a5062a74d9037

  • SHA256

    4faf111886633b8a43e9a7eb56ea594164b20f9b24ec60982b25dbb162b3499a

  • SHA512

    b27b0e00c4bdeae0b307d70f54d8f05c9743672d67a279d4ccc7e211a7ad803889bd4cd10f1068bc1d292e0e19a912d30ad8f758753d4a42a01470bb018fe416

  • SSDEEP

    12288:Wd9MNYrwv9DETz/4RLBbsQob0HbBFMPp3cHi7dxHQvt:WSv9EtJbsWdCi7dxy

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_8ca614e5a46a93622584fbef435ce048

    • Size

      512KB

    • MD5

      8ca614e5a46a93622584fbef435ce048

    • SHA1

      363c300cb3ded18ebc148ab1a01a5062a74d9037

    • SHA256

      4faf111886633b8a43e9a7eb56ea594164b20f9b24ec60982b25dbb162b3499a

    • SHA512

      b27b0e00c4bdeae0b307d70f54d8f05c9743672d67a279d4ccc7e211a7ad803889bd4cd10f1068bc1d292e0e19a912d30ad8f758753d4a42a01470bb018fe416

    • SSDEEP

      12288:Wd9MNYrwv9DETz/4RLBbsQob0HbBFMPp3cHi7dxHQvt:WSv9EtJbsWdCi7dxy

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks