Overview

overview

10

Static

static

3

0e3b42ca05...bd.exe

windows7-x64

10

0e3b42ca05...bd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e3b42ca05aa9fc68bd72a00bf54a9c58465723dd7a8bf72d853e8ce7a7fbfbd

  • Size

    520KB

  • Sample

    250310-yhzf5swygt

  • MD5

    8dd7367d4f6217d792a9f5ad0fb3b64b

  • SHA1

    2c18e3bce4620eabbf9f4f233c8fc0f16863e5f0

  • SHA256

    0e3b42ca05aa9fc68bd72a00bf54a9c58465723dd7a8bf72d853e8ce7a7fbfbd

  • SHA512

    1ef67766e26d8ac0ca693e09ccb8ccc021f0f1b6934f13f875e9c7e73e7f7b6f898b99b62edd54272c42070af63565685997a03c6f738d7968e121b626906712

  • SSDEEP

    12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXp:zW6ncoyqOp6IsTl/mXp

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      0e3b42ca05aa9fc68bd72a00bf54a9c58465723dd7a8bf72d853e8ce7a7fbfbd

    • Size

      520KB

    • MD5

      8dd7367d4f6217d792a9f5ad0fb3b64b

    • SHA1

      2c18e3bce4620eabbf9f4f233c8fc0f16863e5f0

    • SHA256

      0e3b42ca05aa9fc68bd72a00bf54a9c58465723dd7a8bf72d853e8ce7a7fbfbd

    • SHA512

      1ef67766e26d8ac0ca693e09ccb8ccc021f0f1b6934f13f875e9c7e73e7f7b6f898b99b62edd54272c42070af63565685997a03c6f738d7968e121b626906712

    • SSDEEP

      12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXp:zW6ncoyqOp6IsTl/mXp

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks