Overview

overview

10

Static

static

3

JaffaCakes...b7.exe

windows7-x64

10

JaffaCakes...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_54347d438e99d2e5621ee7672408cab7

  • Size

    352KB

  • Sample

    250306-amltvaszfs

  • MD5

    54347d438e99d2e5621ee7672408cab7

  • SHA1

    abb25af8e417806e353a6df0326fa234d84ae150

  • SHA256

    538de94c4dad655940b02a4e72896f1ae09bb99e6ae1e61c4ced7f74a1f52b41

  • SHA512

    375d322c406f0dd5f514eb3e0da64246017d770c7160780651b0161b34e13dc09e4f3e730624e835c6dd11ffd68e976d5602fe3f68a34a794e0e8d5ce09b2df3

  • SSDEEP

    6144:5PYoYd9iXgI5gwvBLrt+ElPYoYd9iXgI5gwvg:5P2sQUXtP2sQUW

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_54347d438e99d2e5621ee7672408cab7

    • Size

      352KB

    • MD5

      54347d438e99d2e5621ee7672408cab7

    • SHA1

      abb25af8e417806e353a6df0326fa234d84ae150

    • SHA256

      538de94c4dad655940b02a4e72896f1ae09bb99e6ae1e61c4ced7f74a1f52b41

    • SHA512

      375d322c406f0dd5f514eb3e0da64246017d770c7160780651b0161b34e13dc09e4f3e730624e835c6dd11ffd68e976d5602fe3f68a34a794e0e8d5ce09b2df3

    • SSDEEP

      6144:5PYoYd9iXgI5gwvBLrt+ElPYoYd9iXgI5gwvg:5P2sQUXtP2sQUW

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistenceratupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks