blackshades | 1e67e2a2f5ed50d1f640f8944cd4557b0a42eea0780e7feffa9cce4a1396e4f9

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 523KB
Sample261013-2e9pgsct7w
SHA256 1e67e2a2f5ed50d1f640f8944cd4557b0a42eea0780e7feffa9cce4a1396e4f9
MD5 0dcbd7656b87833292cbe9985c5d7657
SHA1 95010535e077d488fb9c12e698eb762b5a900ab8
SHA512 8a55fc0576f877451d1ea546301d6d064b2dbc562bbb77e7d389b101fe88479132b2c903cb60bd007cc523acc0c29e366291b81be26605dc2fcba3c46dfd8e08
SSDEEP 12288:iUX/5BTD/GXU3MbK9Q58gY1epZTJFvgGI2/Yp:VzTD7SC8J1th/
TLSH
T131B4E094288AD6A2C21A937F40E0A53178FF1ED2A9F58673DB573C53EA3CAC1152F341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery blackshades rat

Malware Config

Signatures

Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades

Blackshades payload 1 IoCs

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5236 set thread context of 4664	5236	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 4664	5236	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 5236 wrote to memory of 4664	5236	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 5236 wrote to memory of 4664	5236	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 5236 wrote to memory of 4664	5236	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
  2⤵
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4664-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download