Overview

overview

10

Static

static

3

EpicBot.exe

windows7-x64

10

EpicBot.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_222d2253a7fd72920d12c4bcfc64eddf

  • Size

    314KB

  • Sample

    250225-gn8tbs1lt8

  • MD5

    222d2253a7fd72920d12c4bcfc64eddf

  • SHA1

    65595dc6c8dd55b45fc30541999e26bfe7d88765

  • SHA256

    4b423e27c5d8f33e938cda8189f5871f398501a2d09b7c50924a1239226be830

  • SHA512

    329dd100e90e4a7aafa24970c4d67735d78ee0110b67a392986a0add32755cbe123645731133623ae00c69ebc4c5406d59dbfe9ca947bbf8688af21038d1b5f8

  • SSDEEP

    6144:rM/oEhLkxHik3y5/t4zaClprv3RqzxSbDJjXn5Nzb4qBO3tJNlN6:ooEelw5F4z7zT3RScbFjJhbwvDc

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      EpicBot.exe

    • Size

      346KB

    • MD5

      13787f7c58e6ce6297faa9344479603d

    • SHA1

      163d49d21b5888c7ec2af7341c413c01d6b23f72

    • SHA256

      66ff69ad32da209b0472ffc72fd605e6152376041727e806f3ad420cdaadf857

    • SHA512

      b92286e9bbfb336a38edf4adf515ed4fc72b751a25a0f07de6aa6d6e4eaf23163550dace0216b8e22331d6cf2cab701d8b6b403ccdf139c356b4dffbd727da22

    • SSDEEP

      6144:8vvZlrNssDgiizCjytCBeAI+Ns9t4ZkzetyBoID4lAKkFLYN:83ZsY0zCjyI4AIkG4ZPyiID4i3FLi

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks