Extracted

• • Target

    2aca79fda2f8a1921295b09bd486de16_JaffaCakes118

  • Size

    808KB

  • MD5

    2aca79fda2f8a1921295b09bd486de16

  • SHA1

    0e6bf9c82791862d69836bd14aceca46841bf53a

  • SHA256

    19c68f9e178765d9676476754db29a351eb8eebf905bb97b95e0c954520052a5

  • SHA512

    7408354fec602fac9e16b16220d657ced49c39be7a365dd10d6c77c0d955bfce9249520288ded3f454d30e7c38d00b9f615e0b2ffc4cc37ec08498ba793f515e

  • SSDEEP

    12288:D/YzK338/LgnU7wz9yl084/hAQR/8Hcmy6ZzPa8csxEU6LRHb6+js+:kz//Lg5cf4/hVR/88GZO8vOU2Hb6+s+

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggerneshtainfostealerkeyloggerpersistencespywarestealertrojan

  • Detect Neshta payload

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2