Overview

overview

10

Static

static

3

JaffaCakes...b8.exe

windows7-x64

7

JaffaCakes...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_523f04e11cd625c15e72b2261dc240b8

  • Size

    292KB

  • Sample

    250305-qqfp1azmy7

  • MD5

    523f04e11cd625c15e72b2261dc240b8

  • SHA1

    2bb18ca007793a8a3c5f051f09eb450c156e3a82

  • SHA256

    af676fdc5414af52a261661e2c9fda1779c0c8f47cb4fdd8094cb09abac8bef6

  • SHA512

    e157d01abd292fdb9bba781fb4e666f1e386a46431678fdd474884c9965070052755c8595edf513eb30e4ea6c156a5db96a8649b3b75ea9ba077855b52f2d8db

  • SSDEEP

    6144:HlmiYtJM2IjYznwNdZZ5fwVLWurtfG3aYlkWAoKs7XcQ9FMIti9O:HeLZzn6ZHfurt2lkZoKs7XcQXTd

Score
10/10
blackshadesdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_523f04e11cd625c15e72b2261dc240b8

    • Size

      292KB

    • MD5

      523f04e11cd625c15e72b2261dc240b8

    • SHA1

      2bb18ca007793a8a3c5f051f09eb450c156e3a82

    • SHA256

      af676fdc5414af52a261661e2c9fda1779c0c8f47cb4fdd8094cb09abac8bef6

    • SHA512

      e157d01abd292fdb9bba781fb4e666f1e386a46431678fdd474884c9965070052755c8595edf513eb30e4ea6c156a5db96a8649b3b75ea9ba077855b52f2d8db

    • SSDEEP

      6144:HlmiYtJM2IjYznwNdZZ5fwVLWurtfG3aYlkWAoKs7XcQ9FMIti9O:HeLZzn6ZHfurt2lkZoKs7XcQXTd

    Score
    10/10
    discoverypersistenceblackshadesrat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks