Overview

overview

10

Static

static

3

JaffaCakes...d4.exe

windows7-x64

10

JaffaCakes...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_adc844e3b174221e16e0ac1160c008d4

  • Size

    464KB

  • Sample

    250206-v61sbstlcp

  • MD5

    adc844e3b174221e16e0ac1160c008d4

  • SHA1

    6af2dc19c752b97f562be0cdfda9947092dc04f6

  • SHA256

    879e371f52ab0699918e72672d4bd86db3f2154893f8ca63502a4356b052e8e1

  • SHA512

    cf8b23d543ec87c268c7f7c0d2d0b72395fe5e47ccdfdc1139562dc34dc14d27cbf95dd683c7c84aa5134fc69c6fb56c1ba969b0c5836534807be9a0f0f3765a

  • SSDEEP

    12288:5W94GN7fiIEAeLHJx0fL0R5c7pIkH1rUwI/udPdA3hiWKhhaaGwWTYx89xcpG:094GN7fiIEAeLHJx0D4EpIKTVdAxinQp

Score
10/10
blackshadesbootkitdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_adc844e3b174221e16e0ac1160c008d4

    • Size

      464KB

    • MD5

      adc844e3b174221e16e0ac1160c008d4

    • SHA1

      6af2dc19c752b97f562be0cdfda9947092dc04f6

    • SHA256

      879e371f52ab0699918e72672d4bd86db3f2154893f8ca63502a4356b052e8e1

    • SHA512

      cf8b23d543ec87c268c7f7c0d2d0b72395fe5e47ccdfdc1139562dc34dc14d27cbf95dd683c7c84aa5134fc69c6fb56c1ba969b0c5836534807be9a0f0f3765a

    • SSDEEP

      12288:5W94GN7fiIEAeLHJx0fL0R5c7pIkH1rUwI/udPdA3hiWKhhaaGwWTYx89xcpG:094GN7fiIEAeLHJx0D4EpIKTVdAxinQp

    Score
    10/10
    blackshadesbootkitdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks