General

  • Target

    JaffaCakes118_45d867195a7f43b8d6f7bcea8b80ecb0

  • Size

    212KB

  • Sample

    250303-jzhgmasvc1

  • MD5

    45d867195a7f43b8d6f7bcea8b80ecb0

  • SHA1

    185e4cba6ed015329780b5d920fbfc11f0ec4c96

  • SHA256

    4d69fb8319d13ee17ecec72214a7b111dacd2962f0fd5a85f175c0f7f7160e6d

  • SHA512

    5a23d404194fa9a8ed7862f58a9a34ba11a8ef76c8215d1c516965b7702403f94f957c0c6811cb1855edeef4db15df7acfc14fa4f214f990016fe472aba782d9

  • SSDEEP

    6144:0IiIJXjxZw2OTTKkrQfQq65mDzHBVQPpepb5:0IiUZYTKFfQq6oDNMepb5

Malware Config

Targets

    • Target

      JaffaCakes118_45d867195a7f43b8d6f7bcea8b80ecb0

    • Size

      212KB

    • MD5

      45d867195a7f43b8d6f7bcea8b80ecb0

    • SHA1

      185e4cba6ed015329780b5d920fbfc11f0ec4c96

    • SHA256

      4d69fb8319d13ee17ecec72214a7b111dacd2962f0fd5a85f175c0f7f7160e6d

    • SHA512

      5a23d404194fa9a8ed7862f58a9a34ba11a8ef76c8215d1c516965b7702403f94f957c0c6811cb1855edeef4db15df7acfc14fa4f214f990016fe472aba782d9

    • SSDEEP

      6144:0IiIJXjxZw2OTTKkrQfQq65mDzHBVQPpepb5:0IiUZYTKFfQq6oDNMepb5

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks