Extracted

• • Target

    JaffaCakes118_6453b926503f0a47ace96ee12c18bc33

  • Size

    801KB

  • MD5

    6453b926503f0a47ace96ee12c18bc33

  • SHA1

    37cee84fa9803f42ccd049063959570adaa425ba

  • SHA256

    a4e4ac00d4ba53d06796e517e5153981ceb64f6c6cec9ea2498866d31967298f

  • SHA512

    b0c31b05d59dccf9ec4ad7154f1b6e1c381e3d80ea1ce80c1d795ac7d08b2857fda30a1e984d8a79859b70437729ecf14d8a5c76c76babca3c5f2ebc199d21d6

  • SSDEEP

    12288:QwGTnyOtnxv6S4mtDuPa97JnEFEmR3PyiYg6cDL1WtThAVARl6t2YeHFvk3+f:DsyS6xcsEli8iz9uhDknOR

  Score

  10^/10

  blackshadeslatentbotcredential_accessdefense_evasiondiscoverypersistenceratspywarestealertrojan

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2