blackshades | bbb195a391d945cf70d1ac0b623df8f9828f32ace32ccf5c119fc839d0422354 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...7a.exe

windows7-x64

JaffaCakes...7a.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_69e797dba4c07425a90daffaf48dec7a
Size

564KB
Sample

250312-j3dmvatkt7
MD5

69e797dba4c07425a90daffaf48dec7a
SHA1

bb58bfff7053e6399cbb0c14e95b5597429bd0d6
SHA256

bbb195a391d945cf70d1ac0b623df8f9828f32ace32ccf5c119fc839d0422354
SHA512

a3b0a3940d27bb2390c701562de3883e034b5b3fff2c9ca3292291f9e52b338d7b8a6eee561a2e2b2c712fc1eb98b7da232163379a0ffa59febcd3f80ef95f03
SSDEEP

6144:6dnNVPx5eSTlJjc/UyUfVbeY1yPkdFNjwlQ6o0ePt+5UBBfg6+ZD/NsPUtFJ8I//:unPPxLj9bJq6rLg5UBBfgVr2PUtzDGh

Score

10^/10

blackshades bootkit defense_evasion discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_69e797dba4c07425a90daffaf48dec7a.exe

Resource

win7-20240729-en

blackshades bootkit defense_evasion discovery persistence rat

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_69e797dba4c07425a90daffaf48dec7a.exe

Resource

win10v2004-20250217-en

blackshades bootkit defense_evasion discovery persistence rat

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_69e797dba4c07425a90daffaf48dec7a
- Size
  
  564KB
- MD5
  
  69e797dba4c07425a90daffaf48dec7a
- SHA1
  
  bb58bfff7053e6399cbb0c14e95b5597429bd0d6
- SHA256
  
  bbb195a391d945cf70d1ac0b623df8f9828f32ace32ccf5c119fc839d0422354
- SHA512
  
  a3b0a3940d27bb2390c701562de3883e034b5b3fff2c9ca3292291f9e52b338d7b8a6eee561a2e2b2c712fc1eb98b7da232163379a0ffa59febcd3f80ef95f03
- SSDEEP
  
  6144:6dnNVPx5eSTlJjc/UyUfVbeY1yPkdFNjwlQ6o0ePt+5UBBfg6+ZD/NsPUtFJ8I//:unPPxLj9bJq6rLg5UBBfgVr2PUtzDGh
Score

10^/10

blackshades bootkit defense_evasion discovery persistence rat
- Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Blackshades family
  blackshades
- Blackshades payload
- Modifies firewall policy service
  defense_evasion
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

blackshadesbootkitdefense_evasiondiscoverypersistencerat

behavioral2

blackshadesbootkitdefense_evasiondiscoverypersistencerat

© 2018-2025

Terms | Privacy