Extracted

• • Target
    jaffacakes118_Worm.MSIL.Agent.cz.e3783120ec0246f39ad90ac48f42d462
  • Size 2.6MB
  • SHA256 494134ffbd89a96f9010eca2089602d4ce05169c3bfe18dd31e0ed98a9fa8f76
  • MD5 e3783120ec0246f39ad90ac48f42d462
  • SHA1 dba5b01ba11d09b0c43f0efd3b6083fe2efc8c71
  • SHA512 60d9f8d2c8ba26982dd230f735f282400052ab25cd8e2982649859c7e3c6760cc2dabb6e61f5cd84db0c3b51fa67be6ad9de9459962cd505dc93eadd28527731
  • SSDEEP 49152:QglG2Ri1hR8E6MX4qoO1ZTEdgiBqOTGIgc5cYD3avbWufYCQTEivT5SHG+5jR:QgR/E6MXfXxEdgiBqBXYDgvfRATIm+59
  • TLSH
    T16EC5332633D10176E97230309F783412E1B6FE77257B624FF786162ABDA8D42C6A5B43
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarevítimadefense_evasiondiscoveryexecutionblackshadescybergatepersistenceprivilege_escalationratspywarestealertrojanupx

  • Blackshades payload

  • Family: Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2