General

  • Target

    JaffaCakes118_fef526e73d03f5a49e2da27e53fec139

  • Size

    284KB

  • Sample

    250216-dr6atszmbz

  • MD5

    fef526e73d03f5a49e2da27e53fec139

  • SHA1

    75d325048bc2942c425b0e1e8c571fa2ce41c8e3

  • SHA256

    347969f53c001213518c92b41084966cc747a4cff43b36abb2afbc83fec90528

  • SHA512

    21e56e740fca1d83996e109e33bb8b1af827e061fddac04314d2f3d7a6e1fd74156c28bb83e5a85852f0521d2f1901c88e3952991d77b674de5b527997d699f2

  • SSDEEP

    6144:J38Ps8m1OBD/f4r5zn1JSRFr1EWlByUy6QmC+gHKcfXk0GoZ6b:WPpmGDC7PSRd1FBb+hHDfGo

Malware Config

Targets

    • Target

      JaffaCakes118_fef526e73d03f5a49e2da27e53fec139

    • Size

      284KB

    • MD5

      fef526e73d03f5a49e2da27e53fec139

    • SHA1

      75d325048bc2942c425b0e1e8c571fa2ce41c8e3

    • SHA256

      347969f53c001213518c92b41084966cc747a4cff43b36abb2afbc83fec90528

    • SHA512

      21e56e740fca1d83996e109e33bb8b1af827e061fddac04314d2f3d7a6e1fd74156c28bb83e5a85852f0521d2f1901c88e3952991d77b674de5b527997d699f2

    • SSDEEP

      6144:J38Ps8m1OBD/f4r5zn1JSRFr1EWlByUy6QmC+gHKcfXk0GoZ6b:WPpmGDC7PSRd1FBb+hHDfGo

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks