Overview

overview

10

Static

static

10

JaffaCakes...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70

  • Size

    332KB

  • Sample

    250409-b3mazswnt8

  • MD5

    a2a5711a9d2200a395ed21bd32d3af70

  • SHA1

    35f5fd6f7837fde69f2bd7b598b62891721222b8

  • SHA256

    887579f126ed6883f0d78f658552ff55e479a77edb9c90d986a1e73d66b08a57

  • SHA512

    8729144e358228da9cccd408a86a1d42754d55d299b3008af14aed7a9159b5af9f88d5a77cddb1d2d64f1bc6a2479fe345b0233aa53807ffaa0a450008282831

  • SSDEEP

    6144:uiu0srKxP6nVMg1FENy/V/5c6thb+lazG8a:u50srcyLjN/5c6thb+lazGr

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70

    • Size

      332KB

    • MD5

      a2a5711a9d2200a395ed21bd32d3af70

    • SHA1

      35f5fd6f7837fde69f2bd7b598b62891721222b8

    • SHA256

      887579f126ed6883f0d78f658552ff55e479a77edb9c90d986a1e73d66b08a57

    • SHA512

      8729144e358228da9cccd408a86a1d42754d55d299b3008af14aed7a9159b5af9f88d5a77cddb1d2d64f1bc6a2479fe345b0233aa53807ffaa0a450008282831

    • SSDEEP

      6144:uiu0srKxP6nVMg1FENy/V/5c6thb+lazG8a:u50srcyLjN/5c6thb+lazGr

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks