Extracted

• • Target
    jaffacakes118_Trojan.MSIL.Zapchast.ct.f890bf8f1557cef930d407471b43cf8c
  • Size 4.1MB
  • SHA256 165ff1578ec1e7cec6fac6fbbb3522012beb5cb616c2bb8896ae71ff6aa2b3d2
  • MD5 f890bf8f1557cef930d407471b43cf8c
  • SHA1 3ed749f284dd603eb2541b4969f59f4392cf84d0
  • SHA512 ebad83fc861cc66c1c88b556bf5360e53d500b97690c35aba97514f1a842ea9a900a900b62ec4634d5ddd6195f95b889a22f582ca5e91969d20f77766c1848f4
  • SSDEEP 49152:2/gYAhExqWzqobqmOT/WCbk/AWrW6gIfZAnBtk8rk7Re/CJym9B5HXZJNybK21MB:kAhEkWz7
  • TLSH
    T19F1633617F49ADBECA3CC33A60FF6A081A611E51D149D3AB73D831D714AA3829453C7E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  2012defense_evasiondiscoveryexecutionblackshadesdarkcometpersistencerattrojanupx

  • Blackshades payload

  • Family: Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2