General
- Target JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5
- Size 532KB
- Sample250214-eqexxsslev
- SHA256 009a051c04943e14465ace1e70616e72c19a29683283e25639e78fa32057d3ff
Score
10/10
Malware Config
Targets
-
- Target JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5
- Size 532KB
- SHA256 009a051c04943e14465ace1e70616e72c19a29683283e25639e78fa32057d3ff
Score10/10-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload
-
Modifies firewall policy service
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3