blackshades | 1bd2b15b281113aa38e49180b73f11ce48d8f3e901e78b05a2647747093e604c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...23.exe

windows7-x64

JaffaCakes...23.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_04d98191ffcd8d9d67da3a1310e0f123
Size

308KB
Sample

250219-ma22hszq18
MD5

04d98191ffcd8d9d67da3a1310e0f123
SHA1

4c25f1be9f54ae67e008f0b7f11fa0bea976f0b5
SHA256

1bd2b15b281113aa38e49180b73f11ce48d8f3e901e78b05a2647747093e604c
SHA512

3b0c9aad1bb03de27d7f823ec5b9ad9a8e64945cba96fe61f794e8ac1c48f9514154199a1050735eceb5cb642909329c1248f4acdb136a3c1d47c259a6a2069f
SSDEEP

6144:weNybKuAcN3LraNxEjr78/qh9GivFHS6BUimLdO24Tk:we8HdLr57qkcivgUH324

Score

10^/10

blackshades bootkit defense_evasion discovery persistence rat upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_04d98191ffcd8d9d67da3a1310e0f123.exe

Resource

win7-20240903-en

blackshades bootkit defense_evasion discovery persistence rat upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_04d98191ffcd8d9d67da3a1310e0f123.exe

Resource

win10v2004-20250217-en

blackshades bootkit defense_evasion discovery persistence rat upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_04d98191ffcd8d9d67da3a1310e0f123
- Size
  
  308KB
- MD5
  
  04d98191ffcd8d9d67da3a1310e0f123
- SHA1
  
  4c25f1be9f54ae67e008f0b7f11fa0bea976f0b5
- SHA256
  
  1bd2b15b281113aa38e49180b73f11ce48d8f3e901e78b05a2647747093e604c
- SHA512
  
  3b0c9aad1bb03de27d7f823ec5b9ad9a8e64945cba96fe61f794e8ac1c48f9514154199a1050735eceb5cb642909329c1248f4acdb136a3c1d47c259a6a2069f
- SSDEEP
  
  6144:weNybKuAcN3LraNxEjr78/qh9GivFHS6BUimLdO24Tk:we8HdLr57qkcivgUH324
Score

10^/10

blackshades bootkit defense_evasion discovery persistence rat upx
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesbootkitdefense_evasiondiscoverypersistenceratupx

behavioral2

blackshadesbootkitdefense_evasiondiscoverypersistenceratupx

© 2018-2025

Terms | Privacy