blackshades | 39580ada297a8cb5d70b6e14b56b6ca75c34f4fe87006dc83dd2a9d775fb8653 | Triage

Sharing

General

Target

JaffaCakes118_5a3fdfea37abbf7e55c5eecd0b192370
Size

775KB
Sample

250309-vhn4mawtet
MD5

5a3fdfea37abbf7e55c5eecd0b192370
SHA1

1d1123ace253c379f94103d2b4e5ca77323a0a62
SHA256

39580ada297a8cb5d70b6e14b56b6ca75c34f4fe87006dc83dd2a9d775fb8653
SHA512

8606b60923abbdea2fa4408e63da801871f8bd8fce971fc6515b4e344bc7f06df105ba86bcde3db49ef5e00ac023e5ec4b112f2d4c3a10111e416d7a8c12238e
SSDEEP

24576:E3eTCdSLL1znKD1+ZJ/7ZoUMpzNCw8Qfho:+eTwSLpKhGJzRMVMw8

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Targets

- Target
  
  JaffaCakes118_5a3fdfea37abbf7e55c5eecd0b192370
- Size
  
  775KB
- MD5
  
  5a3fdfea37abbf7e55c5eecd0b192370
- SHA1
  
  1d1123ace253c379f94103d2b4e5ca77323a0a62
- SHA256
  
  39580ada297a8cb5d70b6e14b56b6ca75c34f4fe87006dc83dd2a9d775fb8653
- SHA512
  
  8606b60923abbdea2fa4408e63da801871f8bd8fce971fc6515b4e344bc7f06df105ba86bcde3db49ef5e00ac023e5ec4b112f2d4c3a10111e416d7a8c12238e
- SSDEEP
  
  24576:E3eTCdSLL1znKD1+ZJ/7ZoUMpzNCw8Qfho:+eTwSLpKhGJzRMVMw8
Score

10^/10

blackshades defense_evasion discovery persistence rat
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesdefense_evasiondiscoverypersistencerat

behavioral2

blackshadesdefense_evasiondiscoverypersistencerat