blackshades | 380e2e2620b6a4863c32f10a7c35cbb01151ad05e1f77a1442de572d95c440d6 | Triage

Sharing

General

Target

JaffaCakes118_9e31163d76139cacfc7a1f45fda37bb8
Size

1.5MB
Sample

250205-lgmpqssjfq
MD5

9e31163d76139cacfc7a1f45fda37bb8
SHA1

bf7eb9272828f0a83e6579f9aa72f5c463d43d33
SHA256

380e2e2620b6a4863c32f10a7c35cbb01151ad05e1f77a1442de572d95c440d6
SHA512

160004545e91f797aaa192ac8ef3ddfe7166b95e0433d4c34d9f55eb53d15e63dbb99b0ad81d296f7dc82cacc0ced8649bc51ee979d4fb13203eaf47a7b706fd
SSDEEP

12288:i6nn7caf4u9rJviLkCKuCUVI7o+dC/0IOuBWUo7S3mlZPG4cQnmv44m:iyfZrikCKuCzdCtOuBmSWlZPzna44m

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Targets

- Target
  
  JaffaCakes118_9e31163d76139cacfc7a1f45fda37bb8
- Size
  
  1.5MB
- MD5
  
  9e31163d76139cacfc7a1f45fda37bb8
- SHA1
  
  bf7eb9272828f0a83e6579f9aa72f5c463d43d33
- SHA256
  
  380e2e2620b6a4863c32f10a7c35cbb01151ad05e1f77a1442de572d95c440d6
- SHA512
  
  160004545e91f797aaa192ac8ef3ddfe7166b95e0433d4c34d9f55eb53d15e63dbb99b0ad81d296f7dc82cacc0ced8649bc51ee979d4fb13203eaf47a7b706fd
- SSDEEP
  
  12288:i6nn7caf4u9rJviLkCKuCUVI7o+dC/0IOuBWUo7S3mlZPG4cQnmv44m:iyfZrikCKuCzdCtOuBmSWlZPzna44m
Score

10^/10

blackshades defense_evasion discovery persistence rat
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesdefense_evasiondiscoverypersistencerat

behavioral2

blackshadesdefense_evasiondiscoverypersistencerat