Overview

overview

10

Static

static

10

JaffaCakes...b8.exe

windows7-x64

10

JaffaCakes...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_414a933b2eac540dbf773e8de9b8b2b8

  • Size

    112KB

  • Sample

    250302-t39qdsypv6

  • MD5

    414a933b2eac540dbf773e8de9b8b2b8

  • SHA1

    40b7a2370c2b17925dd8bde51ea8171eaa5637a3

  • SHA256

    057578c833d49765b16ffff853363a51a880c352befbe4a65184fbd7226eaf73

  • SHA512

    a065906a8dc47b8743faa62e9455bf24528425f17a03587a54a3759c512730a4eaf636b71e60b4f9be60246fd76eb562b43d5f6c2e658acda37a6ef4e13a99de

  • SSDEEP

    3072:uhs/8Y+SE3aJkUDAeoB+9LVDIH/7ixolIu5M8H:uhs/8Y+DaJkUD8B2Hi

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_414a933b2eac540dbf773e8de9b8b2b8

    • Size

      112KB

    • MD5

      414a933b2eac540dbf773e8de9b8b2b8

    • SHA1

      40b7a2370c2b17925dd8bde51ea8171eaa5637a3

    • SHA256

      057578c833d49765b16ffff853363a51a880c352befbe4a65184fbd7226eaf73

    • SHA512

      a065906a8dc47b8743faa62e9455bf24528425f17a03587a54a3759c512730a4eaf636b71e60b4f9be60246fd76eb562b43d5f6c2e658acda37a6ef4e13a99de

    • SSDEEP

      3072:uhs/8Y+SE3aJkUDAeoB+9LVDIH/7ixolIu5M8H:uhs/8Y+DaJkUD8B2Hi

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistenceratupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks