Extracted

• • Target

    dddf42d9a752e43d4a89e71710f3875b_JaffaCakes118

  • Size

    159KB

  • MD5

    dddf42d9a752e43d4a89e71710f3875b

  • SHA1

    d686c051793a11f5ff47a005c5a484afd413180f

  • SHA256

    4e0faf68d70222b0ea615a6623634dbc4fe375d9aab000afcb3e20c8f803beff

  • SHA512

    f2c3421c50c4a37d56140bb54a192c77f8c06d2587be04b8f326c32faf46678dc8ce611fbbf266cfeed05365c0bafdb8fdba852caf8a74041835f90e76b4202d

  • SSDEEP

    768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJqAaVQXP0JJP5TUv+hQFONrM+rMRa8NB:JxqjQ+P04wsmJC7JJP5YmhQQ2+gRJNRH

  Score

  10^/10

  neshtanjratvictimstestdiscoverypersistencespywarestealertrojan

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2