General

  • Target

    JaffaCakes118_ffe3d5f1a942c4a35a5f415f9dc18013

  • Size

    197KB

  • Sample

    250216-gaz92avnfm

  • MD5

    ffe3d5f1a942c4a35a5f415f9dc18013

  • SHA1

    b5675a249a8dc7bf37e069e2634d38682a7df813

  • SHA256

    0d0e6cf0b263302a431392ba4b29f25bd6d8851c0a2188bf669d000a36baf1c3

  • SHA512

    2d5d8ad956afe4f8aa3b6cfc223e53c7144f4937afdea21c22382dd3023df6ae7eaa4383181b0ffb255303ded352c725133939eab8e08bf9b8858fe2eb8f23bb

  • SSDEEP

    3072:EUDWo2xq2aTme7POFgRyyBBk6lcyt0vcIGR55uxMFTosFqIdLyIxtgJDW9:EddVe7PKLyzrlsuWMPFqEF

Malware Config

Targets

    • Target

      JaffaCakes118_ffe3d5f1a942c4a35a5f415f9dc18013

    • Size

      197KB

    • MD5

      ffe3d5f1a942c4a35a5f415f9dc18013

    • SHA1

      b5675a249a8dc7bf37e069e2634d38682a7df813

    • SHA256

      0d0e6cf0b263302a431392ba4b29f25bd6d8851c0a2188bf669d000a36baf1c3

    • SHA512

      2d5d8ad956afe4f8aa3b6cfc223e53c7144f4937afdea21c22382dd3023df6ae7eaa4383181b0ffb255303ded352c725133939eab8e08bf9b8858fe2eb8f23bb

    • SSDEEP

      3072:EUDWo2xq2aTme7POFgRyyBBk6lcyt0vcIGR55uxMFTosFqIdLyIxtgJDW9:EddVe7PKLyzrlsuWMPFqEF

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks