General

  • Target

    JaffaCakes118_778fa64b37269af3b6486c80dd79d1ee

  • Size

    29.5MB

  • Sample

    250315-xkd3jstqz6

  • MD5

    778fa64b37269af3b6486c80dd79d1ee

  • SHA1

    0c20dacb6ee784096ae58c11ca6e64abbaca187a

  • SHA256

    461d4a0097c1b2878bb46888d99404ee807c2825731e54bc104452553a04ee5d

  • SHA512

    1e13554ebcc31c324e7ebe7c037719383368b526350bd7cdbca3acb7b70c6ce453eaac60a6504953c7ef4e4d6c5b423d42e02eadc664cb1e6894a252a7554241

  • SSDEEP

    786432:Twa2b38/LL7Ew2lWofNlCghmjhG/2/IZZXcZn:us/LL7Ew2fHCq2AZZMZn

Malware Config

Targets

    • Target

      JaffaCakes118_778fa64b37269af3b6486c80dd79d1ee

    • Size

      29.5MB

    • MD5

      778fa64b37269af3b6486c80dd79d1ee

    • SHA1

      0c20dacb6ee784096ae58c11ca6e64abbaca187a

    • SHA256

      461d4a0097c1b2878bb46888d99404ee807c2825731e54bc104452553a04ee5d

    • SHA512

      1e13554ebcc31c324e7ebe7c037719383368b526350bd7cdbca3acb7b70c6ce453eaac60a6504953c7ef4e4d6c5b423d42e02eadc664cb1e6894a252a7554241

    • SSDEEP

      786432:Twa2b38/LL7Ew2lWofNlCghmjhG/2/IZZXcZn:us/LL7Ew2fHCq2AZZMZn

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks