Overview

overview

10

Static

static

3

JaffaCakes...0e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9aa532b1fd62902a506d8da89c77250e

  • Size

    1.1MB

  • Sample

    250405-qaykwawzhy

  • MD5

    9aa532b1fd62902a506d8da89c77250e

  • SHA1

    036729e00d51e6dcb2a9bf4a9c4dc2edb826bb0b

  • SHA256

    88048f38966f71512d52c272b957d0b1850b3d86c7c3f683f2aa73eb2f7bf3e5

  • SHA512

    bb046fadda785a2c3fdc1a7b546a3388b91c31f2d9d6ad4cc1b08459a4225bcb8244b5b07d74c2a0ec495d84d69c44de4d5ac83f8350e1f7e0b8a8e4a29b47df

  • SSDEEP

    12288:9Fsb70EVSfl0B9tcwQ25y/jdE/kpar1qQajOxJbkF2CtS1Yfxt5+bJ1T9/A28NPo:wZ1J5+/r1Tk1jid1YgYmeR

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_9aa532b1fd62902a506d8da89c77250e

    • Size

      1.1MB

    • MD5

      9aa532b1fd62902a506d8da89c77250e

    • SHA1

      036729e00d51e6dcb2a9bf4a9c4dc2edb826bb0b

    • SHA256

      88048f38966f71512d52c272b957d0b1850b3d86c7c3f683f2aa73eb2f7bf3e5

    • SHA512

      bb046fadda785a2c3fdc1a7b546a3388b91c31f2d9d6ad4cc1b08459a4225bcb8244b5b07d74c2a0ec495d84d69c44de4d5ac83f8350e1f7e0b8a8e4a29b47df

    • SSDEEP

      12288:9Fsb70EVSfl0B9tcwQ25y/jdE/kpar1qQajOxJbkF2CtS1Yfxt5+bJ1T9/A28NPo:wZ1J5+/r1Tk1jid1YgYmeR

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks