General

  • Target

    d6eec51fa482ac1236b43ad35ff5d3a2b6048e2a987fff6d0611c3637a226ec9.exe

  • Size

    285KB

  • Sample

    250216-ftj7gstpej

  • MD5

    e2cfb0813b32d1822425a70fd437371b

  • SHA1

    5bb02f5fab2985021b6f669be18e8f1bc3092805

  • SHA256

    d6eec51fa482ac1236b43ad35ff5d3a2b6048e2a987fff6d0611c3637a226ec9

  • SHA512

    bb2346c9f27726d9f82ff469833e9ef28362e05626ee293fbf34b28de6bb4b8788151da3ac2c21f47f52679c9aa3fad97f5d1a28f092153cb3021a009f647772

  • SSDEEP

    6144:+ZyKE4FBg+XHnZYkQGmzRrOEg0q/vjLm1AHkUm1Ys8xiV4DvtsJRlVDqa8GzNHL+:NBaBnmtOwq/+1MkU68raJRHua8G9LcoQ

Malware Config

Targets

    • Target

      d6eec51fa482ac1236b43ad35ff5d3a2b6048e2a987fff6d0611c3637a226ec9.exe

    • Size

      285KB

    • MD5

      e2cfb0813b32d1822425a70fd437371b

    • SHA1

      5bb02f5fab2985021b6f669be18e8f1bc3092805

    • SHA256

      d6eec51fa482ac1236b43ad35ff5d3a2b6048e2a987fff6d0611c3637a226ec9

    • SHA512

      bb2346c9f27726d9f82ff469833e9ef28362e05626ee293fbf34b28de6bb4b8788151da3ac2c21f47f52679c9aa3fad97f5d1a28f092153cb3021a009f647772

    • SSDEEP

      6144:+ZyKE4FBg+XHnZYkQGmzRrOEg0q/vjLm1AHkUm1Ys8xiV4DvtsJRlVDqa8GzNHL+:NBaBnmtOwq/+1MkU68raJRHua8G9LcoQ

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks