blackshades | 5128bbe6232df2b00849ab35225d28cc0c10e52ebd75d69e2561392c3a2d810e | Triage

Sharing

General

Target

5128bbe6232df2b00849ab35225d28cc0c10e52ebd75d69e2561392c3a2d810e
Size

592KB
Sample

250206-31b6sa1ndv
MD5

84d4c77410af35ef6b606c42b8c724bd
SHA1

1427fea664797cbee758e9cd90cea874304710a7
SHA256

5128bbe6232df2b00849ab35225d28cc0c10e52ebd75d69e2561392c3a2d810e
SHA512

b6525535137c70eb84409b160f0851a2435e602e99e079390a8936fa571b56027b57aa05b028052937570bc8ce47228166c66c88f70f5199508ba4a239ccef9a
SSDEEP

12288:ON4HPDeC6YYhMT7FIv3U2Mzgim9yXgswPXsxmzXT2xkRNZbsCGRXQvQhAWbx:ON4H7SYuMT7FIvfMO9nswPXsW6cZbsCy

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Targets

- Target
  
  5128bbe6232df2b00849ab35225d28cc0c10e52ebd75d69e2561392c3a2d810e
- Size
  
  592KB
- MD5
  
  84d4c77410af35ef6b606c42b8c724bd
- SHA1
  
  1427fea664797cbee758e9cd90cea874304710a7
- SHA256
  
  5128bbe6232df2b00849ab35225d28cc0c10e52ebd75d69e2561392c3a2d810e
- SHA512
  
  b6525535137c70eb84409b160f0851a2435e602e99e079390a8936fa571b56027b57aa05b028052937570bc8ce47228166c66c88f70f5199508ba4a239ccef9a
- SSDEEP
  
  12288:ON4HPDeC6YYhMT7FIv3U2Mzgim9yXgswPXsxmzXT2xkRNZbsCGRXQvQhAWbx:ON4H7SYuMT7FIvfMO9nswPXsW6cZbsCy
Score

10^/10

blackshades defense_evasion discovery persistence rat
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesdefense_evasiondiscoverypersistencerat

behavioral2

blackshadesdefense_evasiondiscoverypersistencerat