Overview

overview

10

Static

static

3

dfd60f1545...b4.exe

windows7-x64

10

dfd60f1545...b4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfd60f1545c76bda5f275518b80cca6e6af2f845a5fbd733ae73848cece938b4

  • Size

    520KB

  • Sample

    250303-gdw2sayrv6

  • MD5

    90fac165caf2ed6420d2a6ac3857170c

  • SHA1

    9fb56c084bd4b26daaa4ae8feca5c8daba9163d7

  • SHA256

    dfd60f1545c76bda5f275518b80cca6e6af2f845a5fbd733ae73848cece938b4

  • SHA512

    be4a6ecda08d15008fd37ab554773cbfe06b7ffeba206497180f0e289749ca60cbfd93afbe8def403c8d910b74e809a4b89015430ee69f06c0491f57db9c0f8b

  • SSDEEP

    12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXG:zW6ncoyqOp6IsTl/mXG

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      dfd60f1545c76bda5f275518b80cca6e6af2f845a5fbd733ae73848cece938b4

    • Size

      520KB

    • MD5

      90fac165caf2ed6420d2a6ac3857170c

    • SHA1

      9fb56c084bd4b26daaa4ae8feca5c8daba9163d7

    • SHA256

      dfd60f1545c76bda5f275518b80cca6e6af2f845a5fbd733ae73848cece938b4

    • SHA512

      be4a6ecda08d15008fd37ab554773cbfe06b7ffeba206497180f0e289749ca60cbfd93afbe8def403c8d910b74e809a4b89015430ee69f06c0491f57db9c0f8b

    • SSDEEP

      12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXG:zW6ncoyqOp6IsTl/mXG

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks