Overview

overview

10

Static

static

3

JaffaCakes...3c.exe

windows7-x64

10

JaffaCakes...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_99c377c6e1d03d1d748eb2db3372fa3c

  • Size

    1020KB

  • Sample

    250205-as3dsa1qhl

  • MD5

    99c377c6e1d03d1d748eb2db3372fa3c

  • SHA1

    ca53f8b9d678246cf65c184049544323a6be459e

  • SHA256

    1cf7dfe87e6ef73ab5b21e1292750449c806862b966f5c3edeb609501ffb3faa

  • SHA512

    b0e90e50659b26d0aa6943bf9d11ef81c4092a96bb9aa92e11cbe72961869bb52016af037e6e2efa9d433d42c1476af91d2f9824f515b50397dfb2d63516137f

  • SSDEEP

    24576:jIgF5uTsEwKJq2lHpmsqYASpF2V7nrZ6MxbfMXaPs3fv68kj:8giTW2dpRjf21hxb0XaKfv6Hj

Score
10/10
blackshadesdefense_evasiondiscoveryrattrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_99c377c6e1d03d1d748eb2db3372fa3c

    • Size

      1020KB

    • MD5

      99c377c6e1d03d1d748eb2db3372fa3c

    • SHA1

      ca53f8b9d678246cf65c184049544323a6be459e

    • SHA256

      1cf7dfe87e6ef73ab5b21e1292750449c806862b966f5c3edeb609501ffb3faa

    • SHA512

      b0e90e50659b26d0aa6943bf9d11ef81c4092a96bb9aa92e11cbe72961869bb52016af037e6e2efa9d433d42c1476af91d2f9824f515b50397dfb2d63516137f

    • SSDEEP

      24576:jIgF5uTsEwKJq2lHpmsqYASpF2V7nrZ6MxbfMXaPs3fv68kj:8giTW2dpRjf21hxb0XaKfv6Hj

    Score
    10/10
    blackshadesdefense_evasiondiscoveryrattrojanupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Loads dropped DLL

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks