Overview

overview

10

Static

static

3

JaffaCakes...6e.exe

windows7-x64

10

JaffaCakes...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e

  • Size

    2.7MB

  • Sample

    250305-mg3avswthz

  • MD5

    51ac72aa5af11079f2c2ca22d0bf036e

  • SHA1

    babda013a93e16274212ff57c1eef55856594eeb

  • SHA256

    6ea32525bdd7fb538e97a9ec22b4e7e8c4f3d062d04ec64224f19fef3f6b76f4

  • SHA512

    472aee0848f843784375c578a5afc6d3887099ef6e1841fe9bc24923032ec0fabce7ca0a51fac8ffc4f77393c44ec40dcc947ac5d6aa9ef2b334b7cc5e232e5f

  • SSDEEP

    24576:7X1b1wQfjhVGQzqy7fzyW15DjezqzBxxzyVFwYF69Vi4KtftNdmQgfLaO3TE6L6f:Hn8W66KpHQoRDwNQDxn

Score
10/10
blackshadesdefense_evasiondiscoveryrat

Malware Config

Targets

    • Target

      JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e

    • Size

      2.7MB

    • MD5

      51ac72aa5af11079f2c2ca22d0bf036e

    • SHA1

      babda013a93e16274212ff57c1eef55856594eeb

    • SHA256

      6ea32525bdd7fb538e97a9ec22b4e7e8c4f3d062d04ec64224f19fef3f6b76f4

    • SHA512

      472aee0848f843784375c578a5afc6d3887099ef6e1841fe9bc24923032ec0fabce7ca0a51fac8ffc4f77393c44ec40dcc947ac5d6aa9ef2b334b7cc5e232e5f

    • SSDEEP

      24576:7X1b1wQfjhVGQzqy7fzyW15DjezqzBxxzyVFwYF69Vi4KtftNdmQgfLaO3TE6L6f:Hn8W66KpHQoRDwNQDxn

    Score
    10/10
    blackshadesdefense_evasiondiscoveryrat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks