blackshades | 63c0e5ddf4de6ff77478c8e14bba3b2416dff0051d628b1002b653d692070a2a | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...db.exe

windows7-x64

JaffaCakes...db.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_1c1fb67eb0f53187c684aac2d715bfdb
Size

748KB
Sample

250222-zd66vszp15
MD5

1c1fb67eb0f53187c684aac2d715bfdb
SHA1

bf9bafa426e2289121b5e49e0ab601a2af3af4e6
SHA256

63c0e5ddf4de6ff77478c8e14bba3b2416dff0051d628b1002b653d692070a2a
SHA512

f750258b7600e3feca34fb521df4f9e4acaf6c4152c33d7af19e080ed128fbd5d36aab9b62f86869f0ecaeb1f2e33a23aff9a900eee4cc408db389bccb4795f2
SSDEEP

12288:4RR9++Rc8sGuS+KvtNBXJWZWX5BZ6vlpCAN4KFTbcdFKoIFXuyOEvRU:4RRIrUuS+KvtNBXYZWTZ6dYKJmKoIJif

Score

10^/10

blackshades bootkit defense_evasion discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_1c1fb67eb0f53187c684aac2d715bfdb.exe

Resource

win7-20240729-en

blackshades bootkit defense_evasion discovery persistence rat

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_1c1fb67eb0f53187c684aac2d715bfdb.exe

Resource

win10v2004-20250217-en

blackshades bootkit defense_evasion discovery persistence rat

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_1c1fb67eb0f53187c684aac2d715bfdb
- Size
  
  748KB
- MD5
  
  1c1fb67eb0f53187c684aac2d715bfdb
- SHA1
  
  bf9bafa426e2289121b5e49e0ab601a2af3af4e6
- SHA256
  
  63c0e5ddf4de6ff77478c8e14bba3b2416dff0051d628b1002b653d692070a2a
- SHA512
  
  f750258b7600e3feca34fb521df4f9e4acaf6c4152c33d7af19e080ed128fbd5d36aab9b62f86869f0ecaeb1f2e33a23aff9a900eee4cc408db389bccb4795f2
- SSDEEP
  
  12288:4RR9++Rc8sGuS+KvtNBXJWZWX5BZ6vlpCAN4KFTbcdFKoIFXuyOEvRU:4RRIrUuS+KvtNBXYZWTZ6dYKJmKoIJif
Score

10^/10

blackshades bootkit defense_evasion discovery persistence rat
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesbootkitdefense_evasiondiscoverypersistencerat

behavioral2

blackshadesbootkitdefense_evasiondiscoverypersistencerat

© 2018-2025

Terms | Privacy