General

  • Target

    55091174ed9db1cbee1675d3a7b3a01c_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240717-19rayssclk

  • MD5

    55091174ed9db1cbee1675d3a7b3a01c

  • SHA1

    934518658b3831021dbca760f40909ad9ad04851

  • SHA256

    7d4a0ed22b940573f669991fb6992797534221411f338d1e26bd94421b09c2da

  • SHA512

    5ac7ceecdc201b0728d8ecb7baa0b045bcf0491816126f978abae7de614424ac7ca23bc1b53e0657805392f42284ac50ed44137dbfba30b89c106bbd54a92ae9

  • SSDEEP

    24576:kjhLOnG5rh880kdSHhzzTub3n3+BYDruidjis:CsgF818GhzzTu7uq7

Malware Config

Targets

    • Target

      55091174ed9db1cbee1675d3a7b3a01c_JaffaCakes118

    • Size

      1.1MB

    • MD5

      55091174ed9db1cbee1675d3a7b3a01c

    • SHA1

      934518658b3831021dbca760f40909ad9ad04851

    • SHA256

      7d4a0ed22b940573f669991fb6992797534221411f338d1e26bd94421b09c2da

    • SHA512

      5ac7ceecdc201b0728d8ecb7baa0b045bcf0491816126f978abae7de614424ac7ca23bc1b53e0657805392f42284ac50ed44137dbfba30b89c106bbd54a92ae9

    • SSDEEP

      24576:kjhLOnG5rh880kdSHhzzTub3n3+BYDruidjis:CsgF818GhzzTu7uq7

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks