General

  • Target

    JaffaCakes118_a39e1623f2c539a156c835df323debe7

  • Size

    215KB

  • Sample

    250205-znmvza1qhw

  • MD5

    a39e1623f2c539a156c835df323debe7

  • SHA1

    8b9761f5f7cb25bc8f6e300d62aa7eafba1c6180

  • SHA256

    121309ca69b2b20e86326a07ab3490f9e93e1be00eecf0f0eb6dc9f753249522

  • SHA512

    37e4a5f9b38b7c0d0c97bfd99b9853b9648fa67c91238845b52ac77e5e2c4ba122f426197bdeea29ebf7ccb1b58a751c7929a0e2da940af4f05ceecc84b3a714

  • SSDEEP

    6144:W7haf5M4KarKPoFkNy892oEIWbmbkUpubr2onI:9fSt5oFk8+2oEITbkUUby

Malware Config

Targets

    • Target

      JaffaCakes118_a39e1623f2c539a156c835df323debe7

    • Size

      215KB

    • MD5

      a39e1623f2c539a156c835df323debe7

    • SHA1

      8b9761f5f7cb25bc8f6e300d62aa7eafba1c6180

    • SHA256

      121309ca69b2b20e86326a07ab3490f9e93e1be00eecf0f0eb6dc9f753249522

    • SHA512

      37e4a5f9b38b7c0d0c97bfd99b9853b9648fa67c91238845b52ac77e5e2c4ba122f426197bdeea29ebf7ccb1b58a751c7929a0e2da940af4f05ceecc84b3a714

    • SSDEEP

      6144:W7haf5M4KarKPoFkNy892oEIWbmbkUpubr2onI:9fSt5oFk8+2oEITbkUUby

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks