Overview

overview

10

Static

static

5

JaffaCakes...62.exe

windows7-x64

10

JaffaCakes...62.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4f6c1423cbf7268d93b9c465e6b95f62

  • Size

    339KB

  • Sample

    250304-y4zn2azpt4

  • MD5

    4f6c1423cbf7268d93b9c465e6b95f62

  • SHA1

    ed840a02bcab048a63777e5a1dec90171ec2c2f2

  • SHA256

    ecce39865c57cb6177a0c3c4f193afc45b678262cb2039d3f1c4bc64e21d3e44

  • SHA512

    3264f02767fdefbf1a41a52ae7d8c5682e58e221643bed7b808a9278c3f597965029f7b821dd972e2b69e5c8b968815178fb997547bf899220a0990ad865999a

  • SSDEEP

    6144:LLEchZLsu1AcKKIFrMg3p/UHLEhtfwjH5fc1zdLThGniSRxixV4naNiEGoZSKaUh:8iZLn1SKIFlUHLEk75UJdcniSRxuV4ap

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_4f6c1423cbf7268d93b9c465e6b95f62

    • Size

      339KB

    • MD5

      4f6c1423cbf7268d93b9c465e6b95f62

    • SHA1

      ed840a02bcab048a63777e5a1dec90171ec2c2f2

    • SHA256

      ecce39865c57cb6177a0c3c4f193afc45b678262cb2039d3f1c4bc64e21d3e44

    • SHA512

      3264f02767fdefbf1a41a52ae7d8c5682e58e221643bed7b808a9278c3f597965029f7b821dd972e2b69e5c8b968815178fb997547bf899220a0990ad865999a

    • SSDEEP

      6144:LLEchZLsu1AcKKIFrMg3p/UHLEhtfwjH5fc1zdLThGniSRxixV4naNiEGoZSKaUh:8iZLn1SKIFlUHLEk75UJdcniSRxuV4ap

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerattrojanupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks