Overview

overview

10

Static

static

5

JaffaCakes...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a2c07185289b5a561f3461b921a488ab

  • Size

    155KB

  • Sample

    250409-cljdfawrv2

  • MD5

    a2c07185289b5a561f3461b921a488ab

  • SHA1

    525df52cb136c6157f0d5a03401b2f0f663530a1

  • SHA256

    40cb1b01ed8134da3166a01c07b100437ef4c0bd2ed5eb92c20d378866e56083

  • SHA512

    541cf4ac7cfeaf2c2fbea09e0fbde401bc975dc3e523696a5556fb053d881941597a12663c37e0d4018e8c680640f14899013cc54a2a0b733d7b1ca0f2874db6

  • SSDEEP

    3072:X3+OaukQv5C48A/6l+fRGkgacVK33hCJV6opNKjutbo:+sE0/4wZKKap4yu

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_a2c07185289b5a561f3461b921a488ab

    • Size

      155KB

    • MD5

      a2c07185289b5a561f3461b921a488ab

    • SHA1

      525df52cb136c6157f0d5a03401b2f0f663530a1

    • SHA256

      40cb1b01ed8134da3166a01c07b100437ef4c0bd2ed5eb92c20d378866e56083

    • SHA512

      541cf4ac7cfeaf2c2fbea09e0fbde401bc975dc3e523696a5556fb053d881941597a12663c37e0d4018e8c680640f14899013cc54a2a0b733d7b1ca0f2874db6

    • SSDEEP

      3072:X3+OaukQv5C48A/6l+fRGkgacVK33hCJV6opNKjutbo:+sE0/4wZKKap4yu

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistenceratupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks