blackshades | 3b4a73ddaf30847c6ba3bd7dc03f32fdd36ed6b7f14f7fe0015567de6b79b94f | Triage™

Login
Reports

Overview

overview

Static

static

3

jaffacakes...b7.exe

windows10-2004-x64

jaffacakes...b7.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__d06eb2a250211b101075de4f3492a2b7
Size 380KB
Sample260917-2ynaladh59
SHA256 3b4a73ddaf30847c6ba3bd7dc03f32fdd36ed6b7f14f7fe0015567de6b79b94f
MD5 d06eb2a250211b101075de4f3492a2b7
SHA1 772a430f56fde11e096f9dbd31ece594b66c9c8e
SHA512 d945f5479eee154cdc24e1b0228710969c918e9103a6e84afb91b4a593a9bc727f447da24a6eb1f4ab18447b0ca97cc0bf8b4f1f4f6c10be6315d07d6aa728d8
SSDEEP 6144:/xMGCdFxprRQoasPcHA8kh/Fg8Uw5BN5jT0zgS+OY9RHHtT2jtcpr1HA:/KNTrRQz5g8w/Fg81BHMgShHpW1g
TLSH
T10284232577A3C159DCFA2A341EC225921FBB971F9FC2AF4DB4C2432638BB9458543274
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

blackshades hawkeye defense_evasion discovery execution keylogger persistence privilege_escalation rat spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

jaffacakes118__d06eb2a250211b101075de4f3492a2b7.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

13 signatures

150 seconds

defense_evasion discovery execution blackshades hawkeye keylogger persistence privilege_escalation rat spyware stealer trojan

Behavioral task

behavioral2

Sample

jaffacakes118__d06eb2a250211b101075de4f3492a2b7.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

discovery blackshades persistence privilege_escalation rat

Malware Config

Targets

- Target
  jaffacakes118__d06eb2a250211b101075de4f3492a2b7
- Size 380KB
- SHA256 3b4a73ddaf30847c6ba3bd7dc03f32fdd36ed6b7f14f7fe0015567de6b79b94f
- MD5 d06eb2a250211b101075de4f3492a2b7
- SHA1 772a430f56fde11e096f9dbd31ece594b66c9c8e
- SHA512 d945f5479eee154cdc24e1b0228710969c918e9103a6e84afb91b4a593a9bc727f447da24a6eb1f4ab18447b0ca97cc0bf8b4f1f4f6c10be6315d07d6aa728d8
- SSDEEP 6144:/xMGCdFxprRQoasPcHA8kh/Fg8Uw5BN5jT0zgS+OY9RHHtT2jtcpr1HA:/KNTrRQz5g8w/Fg81BHMgShHpW1g
- TLSH
  T10284232577A3C159DCFA2A341EC225921FBB971F9FC2AF4DB4C2432638BB9458543274
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution blackshades hawkeye keylogger persistence privilege_escalation rat spyware stealer trojan
- Blackshades payload
- Family: Blackshades
  Blackshades is a remote access trojan with various capabilities.
  rat blackshades
- Family: HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Modifies firewall policy service
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionblackshadeshawkeyekeyloggerpersistenceprivilege_escalationratspywarestealertrojan

behavioral2

discoveryblackshadespersistenceprivilege_escalationrat

© 2018-2026

Terms | Privacy