Overview

overview

10

Static

static

3

JaffaCakes...1a.exe

windows7-x64

10

JaffaCakes...1a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4eebbfa63ea5e81bf9673c9532167f1a

  • Size

    600KB

  • Sample

    250304-wxjywsxsav

  • MD5

    4eebbfa63ea5e81bf9673c9532167f1a

  • SHA1

    2c398bcf33a9a5b66124f33d90d4be9520758e5a

  • SHA256

    14029dafd99a9c57af12a45bed08edb63483c0ee02ac1cb2b628ca3d57b66e12

  • SHA512

    01320c1ca10b6546bf6ca08e4c3aee20c69a35ccbefde1be27b42119ca5b164f87bd3db45fac835884b13dd1eae5a45f717d2fb16413e30ad9729c6264b7de11

  • SSDEEP

    12288:jY2wMsfAAH5YaSj0e6GNYAfapdCtNSVhBLV5Y2dPyzPLhSOzPLvO:/s4AB93GnfcENcBp56zPTzPy

Score
10/10
blackshadesbootkitdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_4eebbfa63ea5e81bf9673c9532167f1a

    • Size

      600KB

    • MD5

      4eebbfa63ea5e81bf9673c9532167f1a

    • SHA1

      2c398bcf33a9a5b66124f33d90d4be9520758e5a

    • SHA256

      14029dafd99a9c57af12a45bed08edb63483c0ee02ac1cb2b628ca3d57b66e12

    • SHA512

      01320c1ca10b6546bf6ca08e4c3aee20c69a35ccbefde1be27b42119ca5b164f87bd3db45fac835884b13dd1eae5a45f717d2fb16413e30ad9729c6264b7de11

    • SSDEEP

      12288:jY2wMsfAAH5YaSj0e6GNYAfapdCtNSVhBLV5Y2dPyzPLhSOzPLvO:/s4AB93GnfcENcBp56zPTzPy

    Score
    10/10
    blackshadesbootkitdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks