General

  • Target

    JaffaCakes118_fe2e1a4db479acf8b3ce79b7a6358bc1

  • Size

    202KB

  • Sample

    250216-bnxheavmax

  • MD5

    fe2e1a4db479acf8b3ce79b7a6358bc1

  • SHA1

    3b869655a82da49b99c2b31704dddb23c50de510

  • SHA256

    4eaa0bc0fa2e8596496c286c8aacb2504a132438f6e3b8dfa456835b88a6d3f3

  • SHA512

    01e42ab866444179d1d03b728492917a23fcbc62b501b443474294e1b3e706eeca69e97e12730dbfd5d695a3b84cea6790dcc58de519f95bab14a9d6902f5edc

  • SSDEEP

    6144:2+y9Js5s7RoQluIxoXk1eIvHtu2/QSKo/N3:95aRsIx0BIvw2b1N

Malware Config

Targets

    • Target

      JaffaCakes118_fe2e1a4db479acf8b3ce79b7a6358bc1

    • Size

      202KB

    • MD5

      fe2e1a4db479acf8b3ce79b7a6358bc1

    • SHA1

      3b869655a82da49b99c2b31704dddb23c50de510

    • SHA256

      4eaa0bc0fa2e8596496c286c8aacb2504a132438f6e3b8dfa456835b88a6d3f3

    • SHA512

      01e42ab866444179d1d03b728492917a23fcbc62b501b443474294e1b3e706eeca69e97e12730dbfd5d695a3b84cea6790dcc58de519f95bab14a9d6902f5edc

    • SSDEEP

      6144:2+y9Js5s7RoQluIxoXk1eIvHtu2/QSKo/N3:95aRsIx0BIvw2b1N

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks