blackshades | e32fedaa29bc6b47f5a4ef8a9b3316017d63ecf50f409d795513ae441cab7360 | Triage

Sharing

General

Target

JaffaCakes118_abe395d3e6bfad78fa2e55d8b01b0399
Size

624KB
Sample

250206-q5xl3aylfm
MD5

abe395d3e6bfad78fa2e55d8b01b0399
SHA1

696cc32e2c43f35e732a5a70b7cf879ce8b4ad54
SHA256

e32fedaa29bc6b47f5a4ef8a9b3316017d63ecf50f409d795513ae441cab7360
SHA512

ca1d92712984746a1d715415baf1629375084fa35b4f8d1ebff13682a34fd5a253ed20a551b1132183fbc8a29ddd852fed6b4e6d76c8b3d4dc89074c2fb8f7f8
SSDEEP

12288:7DEYaUcamFQJDZF1F1tZsRvdBdtT7UqfSlq2v8LS2I3v9paa:SUcamFQxZF1DMvdBjvasn/I3v9pB

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Targets

- Target
  
  JaffaCakes118_abe395d3e6bfad78fa2e55d8b01b0399
- Size
  
  624KB
- MD5
  
  abe395d3e6bfad78fa2e55d8b01b0399
- SHA1
  
  696cc32e2c43f35e732a5a70b7cf879ce8b4ad54
- SHA256
  
  e32fedaa29bc6b47f5a4ef8a9b3316017d63ecf50f409d795513ae441cab7360
- SHA512
  
  ca1d92712984746a1d715415baf1629375084fa35b4f8d1ebff13682a34fd5a253ed20a551b1132183fbc8a29ddd852fed6b4e6d76c8b3d4dc89074c2fb8f7f8
- SSDEEP
  
  12288:7DEYaUcamFQJDZF1F1tZsRvdBdtT7UqfSlq2v8LS2I3v9paa:SUcamFQxZF1DMvdBjvasn/I3v9pB
Score

10^/10

blackshades defense_evasion discovery persistence rat
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesdefense_evasiondiscoverypersistencerat

behavioral2

blackshadesdefense_evasiondiscoverypersistencerat