blackshades | 30ade14cb6ce823ee2b276c28a7e983e521fa3389ab2956b95405bd145f966fc | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...13.exe

windows7-x64

JaffaCakes...13.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_1cb36dda87c6a616cea7655c453a8d13
Size

224KB
Sample

250222-2kr2ma1mfq
MD5

1cb36dda87c6a616cea7655c453a8d13
SHA1

0ae7706f3c8c55e3ec231e3ab41384e18e026096
SHA256

30ade14cb6ce823ee2b276c28a7e983e521fa3389ab2956b95405bd145f966fc
SHA512

97907d68533505a3dce2696b4ba2db8327d4765f16fa4bc94619a5b29aa2d0e38611d5e1dad34f8c2c1d7809b7868d78cb267715586e9a7ba1c7ea18bc1f8be1
SSDEEP

6144:nt7qdYF7LnIvfWj1aixUm5/afVt9/g1+ANQ:1fU+9x9/ibY1TQ

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_1cb36dda87c6a616cea7655c453a8d13.exe

Resource

win7-20240903-en

blackshades defense_evasion discovery persistence rat upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_1cb36dda87c6a616cea7655c453a8d13.exe

Resource

win10v2004-20250217-en

blackshades defense_evasion discovery persistence rat upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_1cb36dda87c6a616cea7655c453a8d13
- Size
  
  224KB
- MD5
  
  1cb36dda87c6a616cea7655c453a8d13
- SHA1
  
  0ae7706f3c8c55e3ec231e3ab41384e18e026096
- SHA256
  
  30ade14cb6ce823ee2b276c28a7e983e521fa3389ab2956b95405bd145f966fc
- SHA512
  
  97907d68533505a3dce2696b4ba2db8327d4765f16fa4bc94619a5b29aa2d0e38611d5e1dad34f8c2c1d7809b7868d78cb267715586e9a7ba1c7ea18bc1f8be1
- SSDEEP
  
  6144:nt7qdYF7LnIvfWj1aixUm5/afVt9/g1+ANQ:1fU+9x9/ibY1TQ
Score

10^/10

blackshades defense_evasion discovery persistence rat upx
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesdefense_evasiondiscoverypersistenceratupx

behavioral2

blackshadesdefense_evasiondiscoverypersistenceratupx

© 2018-2025

Terms | Privacy