Overview

overview

10

Static

static

3

JaffaCakes...20.exe

windows7-x64

10

JaffaCakes...20.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_40d9dc3a96c5bd3c0d6b8a9720a98020

  • Size

    956KB

  • Sample

    250302-rx93vsxky5

  • MD5

    40d9dc3a96c5bd3c0d6b8a9720a98020

  • SHA1

    f95608a522a0d6d1eff67c6f1fc3ed741b9c1659

  • SHA256

    0693997c84c398508ab80e9eaab6e316f3a1e5ebc4c8e7ba47fa64652077f031

  • SHA512

    d0f7afcd8db90f68c3559fd8bcafe3d1968fed50f2ae0ecee86dd49e642d54bdaeb8f8005cc72ec992afb9a47456f9677bf80bb934be8eb4792f34a40030aa37

  • SSDEEP

    24576:X9EomdCfkvLwbZMQK9coxyN4f8+7s74Se8k+:XCljU+7sK8k+

Score
10/10
blackshadesdefense_evasiondiscoveryrat

Malware Config

Targets

    • Target

      JaffaCakes118_40d9dc3a96c5bd3c0d6b8a9720a98020

    • Size

      956KB

    • MD5

      40d9dc3a96c5bd3c0d6b8a9720a98020

    • SHA1

      f95608a522a0d6d1eff67c6f1fc3ed741b9c1659

    • SHA256

      0693997c84c398508ab80e9eaab6e316f3a1e5ebc4c8e7ba47fa64652077f031

    • SHA512

      d0f7afcd8db90f68c3559fd8bcafe3d1968fed50f2ae0ecee86dd49e642d54bdaeb8f8005cc72ec992afb9a47456f9677bf80bb934be8eb4792f34a40030aa37

    • SSDEEP

      24576:X9EomdCfkvLwbZMQK9coxyN4f8+7s74Se8k+:XCljU+7sK8k+

    Score
    10/10
    blackshadesdefense_evasiondiscoveryrat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks