Overview

overview

10

Static

static

3

JaffaCakes...99.exe

windows7-x64

10

JaffaCakes...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_21ca1ae5645831681e31dde41254b799

  • Size

    608KB

  • Sample

    250225-blz6hs1my8

  • MD5

    21ca1ae5645831681e31dde41254b799

  • SHA1

    62b381e8611cf91a0b3aa8e2374aa8951121b98c

  • SHA256

    92a27875f95dedd4bb16685b0ec996634ab83054ec1972db713ec5c1ad794c86

  • SHA512

    2701c81d4d9d26ba890cab4c04fee6c1de2b8486e9696555042e598586af3154b31e201fb1bd3c9ef375a20bc830da47112430f96339cc7756d81236ae797e7d

  • SSDEEP

    12288:RomRDdDrumc/yr+Y59NV6pq+jmhst6GcjWRBMla:/RRrhc/yr+Y5921jmhG6GcjWRBMl

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_21ca1ae5645831681e31dde41254b799

    • Size

      608KB

    • MD5

      21ca1ae5645831681e31dde41254b799

    • SHA1

      62b381e8611cf91a0b3aa8e2374aa8951121b98c

    • SHA256

      92a27875f95dedd4bb16685b0ec996634ab83054ec1972db713ec5c1ad794c86

    • SHA512

      2701c81d4d9d26ba890cab4c04fee6c1de2b8486e9696555042e598586af3154b31e201fb1bd3c9ef375a20bc830da47112430f96339cc7756d81236ae797e7d

    • SSDEEP

      12288:RomRDdDrumc/yr+Y59NV6pq+jmhst6GcjWRBMla:/RRrhc/yr+Y5921jmhG6GcjWRBMl

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks