General
-
Target
2a989cd31a5347ef9dda477db1ea01b5214e97bf26913b474aeb1950bccb8ac2
-
Size
520KB
-
Sample
250315-2bl41sypv8
-
MD5
04e5a3f290a73b0fb184d745652db087
-
SHA1
6cde89d0c1535321c5ddae1c7b7ee07b3f4ea1de
-
SHA256
2a989cd31a5347ef9dda477db1ea01b5214e97bf26913b474aeb1950bccb8ac2
-
SHA512
24e120718db719626a7dba90967f0f81016f8a2f7d35ed188d53430f16c2e90dfa9e76f898018435d75fb1edca9674afa5eca9915086b4a6d56bc60c617206b2
-
SSDEEP
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXv:zW6ncoyqOp6IsTl/mXv
Static task
static1
Behavioral task
behavioral1
Sample
2a989cd31a5347ef9dda477db1ea01b5214e97bf26913b474aeb1950bccb8ac2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2a989cd31a5347ef9dda477db1ea01b5214e97bf26913b474aeb1950bccb8ac2.exe
Resource
win10v2004-20250314-en
Malware Config
Targets
-
-
Target
2a989cd31a5347ef9dda477db1ea01b5214e97bf26913b474aeb1950bccb8ac2
-
Size
520KB
-
MD5
04e5a3f290a73b0fb184d745652db087
-
SHA1
6cde89d0c1535321c5ddae1c7b7ee07b3f4ea1de
-
SHA256
2a989cd31a5347ef9dda477db1ea01b5214e97bf26913b474aeb1950bccb8ac2
-
SHA512
24e120718db719626a7dba90967f0f81016f8a2f7d35ed188d53430f16c2e90dfa9e76f898018435d75fb1edca9674afa5eca9915086b4a6d56bc60c617206b2
-
SSDEEP
12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXv:zW6ncoyqOp6IsTl/mXv
-
Blackshades family
-
Blackshades payload
-
Modifies firewall policy service
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3