General

  • Target

    0ea4c39db5242721cc91abd101d0aed38d11ab53f04c5af523d04dea7be7a6a7

  • Size

    520KB

  • Sample

    250314-yzb26s1rs7

  • MD5

    45ef903e2f6bf944ec9124f9717c9c45

  • SHA1

    07424e7443ca4b45c1db9801c9ce4d9878e1de51

  • SHA256

    0ea4c39db5242721cc91abd101d0aed38d11ab53f04c5af523d04dea7be7a6a7

  • SHA512

    6a76ca3aa81f655a5d836adf86b2b85037e16de95e42f67fd23bef4d43b4d1069b9d043862def4fb06f2de6885a889235aa9d5f1e18c47ec2ec12a2ea2824bd8

  • SSDEEP

    12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioX2:zW6ncoyqOp6IsTl/mX2

Malware Config

Targets

    • Target

      0ea4c39db5242721cc91abd101d0aed38d11ab53f04c5af523d04dea7be7a6a7

    • Size

      520KB

    • MD5

      45ef903e2f6bf944ec9124f9717c9c45

    • SHA1

      07424e7443ca4b45c1db9801c9ce4d9878e1de51

    • SHA256

      0ea4c39db5242721cc91abd101d0aed38d11ab53f04c5af523d04dea7be7a6a7

    • SHA512

      6a76ca3aa81f655a5d836adf86b2b85037e16de95e42f67fd23bef4d43b4d1069b9d043862def4fb06f2de6885a889235aa9d5f1e18c47ec2ec12a2ea2824bd8

    • SSDEEP

      12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioX2:zW6ncoyqOp6IsTl/mX2

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks