General

  • Target

    JaffaCakes118_e5931f3edadb44983ba778efb59d16a9

  • Size

    487KB

  • Sample

    250211-myabeavken

  • MD5

    e5931f3edadb44983ba778efb59d16a9

  • SHA1

    1e29390a28bd647bc11060d804a98f6527c3493e

  • SHA256

    269fe1396c7ff18f950672c66093b32796f5445cc986a2237b9b8f87dc6afc7a

  • SHA512

    f7ce1424e921f2213c9478a60b7b45afea873a04ba917f60a3de714f54341cce43f2214cb73edd89244b458b2a52385beaac5ed5b3d3e721f6e3a9c9eb850950

  • SSDEEP

    12288:FIcjLmMlrDLN6YUsViowOx8+AxrEZNs0xDakISnTzFqhE:2krhio/hAx47xDakISohE

Malware Config

Targets

    • Target

      JaffaCakes118_e5931f3edadb44983ba778efb59d16a9

    • Size

      487KB

    • MD5

      e5931f3edadb44983ba778efb59d16a9

    • SHA1

      1e29390a28bd647bc11060d804a98f6527c3493e

    • SHA256

      269fe1396c7ff18f950672c66093b32796f5445cc986a2237b9b8f87dc6afc7a

    • SHA512

      f7ce1424e921f2213c9478a60b7b45afea873a04ba917f60a3de714f54341cce43f2214cb73edd89244b458b2a52385beaac5ed5b3d3e721f6e3a9c9eb850950

    • SSDEEP

      12288:FIcjLmMlrDLN6YUsViowOx8+AxrEZNs0xDakISnTzFqhE:2krhio/hAx47xDakISohE

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks