Overview

overview

10

Static

static

3

JaffaCakes...00.exe

windows7-x64

10

JaffaCakes...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_2f04515a1df6a46899087dd353454500

  • Size

    636KB

  • Sample

    250227-xskkasvzez

  • MD5

    2f04515a1df6a46899087dd353454500

  • SHA1

    4c2cab9e6506dc4667209b811c1301a2be45ff38

  • SHA256

    db7cffadc3c6d3b5b67719eb4df12e83590cf91f05a89839af2456f18181e2bf

  • SHA512

    b46bee46132927ddd80e39f7b5b274e516582b29a67ebb977363ec0b55648a60182203321b9f0c790bb6e2237f3d210ca74732e3672d12ca18cd7e95d8384b6b

  • SSDEEP

    12288:TgGOKUQMBKucHMsiz0W1Qvsx3TL3feuz/qdp6qor9Ay8tK:cGBsBcssiZJve6Ku

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_2f04515a1df6a46899087dd353454500

    • Size

      636KB

    • MD5

      2f04515a1df6a46899087dd353454500

    • SHA1

      4c2cab9e6506dc4667209b811c1301a2be45ff38

    • SHA256

      db7cffadc3c6d3b5b67719eb4df12e83590cf91f05a89839af2456f18181e2bf

    • SHA512

      b46bee46132927ddd80e39f7b5b274e516582b29a67ebb977363ec0b55648a60182203321b9f0c790bb6e2237f3d210ca74732e3672d12ca18cd7e95d8384b6b

    • SSDEEP

      12288:TgGOKUQMBKucHMsiz0W1Qvsx3TL3feuz/qdp6qor9Ay8tK:cGBsBcssiZJve6Ku

    Score
    10/10
    defense_evasiondiscoverypersistenceupxblackshadesrat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks