Overview

overview

10

Static

static

10

d1acd690c6...18.exe

windows7-x64

10

d1acd690c6...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d1acd690c623890ca9270f99675a3302_JaffaCakes118

  • Size

    151KB

  • Sample

    240907-l2766sydkg

  • MD5

    d1acd690c623890ca9270f99675a3302

  • SHA1

    f181d4b9028a75b08877e2d04b1c11bd0f4f9a8b

  • SHA256

    2bda18022ca41aa1d5e7919cc9bcb2319698971e1b7865608c61b16c293b0753

  • SHA512

    81cae006aa17fe2c5eb841413899aa6d36a7f15db097c5e1699502f45e27707757c5e7e55942a40a4975fcdc5c76f0a467afa81df7b19202fc48314156c677d7

  • SSDEEP

    3072:sr85Cxb+aLQ2A+Wo1/op4qUqfrIQr85C:k9xo2A+WoKg659

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      d1acd690c623890ca9270f99675a3302_JaffaCakes118

    • Size

      151KB

    • MD5

      d1acd690c623890ca9270f99675a3302

    • SHA1

      f181d4b9028a75b08877e2d04b1c11bd0f4f9a8b

    • SHA256

      2bda18022ca41aa1d5e7919cc9bcb2319698971e1b7865608c61b16c293b0753

    • SHA512

      81cae006aa17fe2c5eb841413899aa6d36a7f15db097c5e1699502f45e27707757c5e7e55942a40a4975fcdc5c76f0a467afa81df7b19202fc48314156c677d7

    • SSDEEP

      3072:sr85Cxb+aLQ2A+Wo1/op4qUqfrIQr85C:k9xo2A+WoKg659

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks