Overview

overview

10

Static

static

10

decf0da4ac...18.exe

windows7-x64

10

decf0da4ac...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    decf0da4acf5690dddf15e98c6d94561_JaffaCakes118

  • Size

    875KB

  • Sample

    240913-yrzs9swbrj

  • MD5

    decf0da4acf5690dddf15e98c6d94561

  • SHA1

    e6ed655ac6df286641c748a8426f80ffd822c6af

  • SHA256

    89aa6ade5ed5525e2e0c6f181539bd24c36d8a633b9e48f00e81da637c881c80

  • SHA512

    3016c8f97046274ebb757bfdaef58f36ed99ad586ce3d69fe812ede142a0903bb5fc798eeedc077cae944dac8ce3483a99781e2b997f024c7f79362cbb078098

  • SSDEEP

    24576:AlDV36hGLc1KDUWyUjPUA5kjLic7xCRXD:IwfKDUWzTUA5k6G4D

Score
10/10
neshtaaspackv2discoverypersistencespywarestealer

Malware Config

Targets

    • Target

      decf0da4acf5690dddf15e98c6d94561_JaffaCakes118

    • Size

      875KB

    • MD5

      decf0da4acf5690dddf15e98c6d94561

    • SHA1

      e6ed655ac6df286641c748a8426f80ffd822c6af

    • SHA256

      89aa6ade5ed5525e2e0c6f181539bd24c36d8a633b9e48f00e81da637c881c80

    • SHA512

      3016c8f97046274ebb757bfdaef58f36ed99ad586ce3d69fe812ede142a0903bb5fc798eeedc077cae944dac8ce3483a99781e2b997f024c7f79362cbb078098

    • SSDEEP

      24576:AlDV36hGLc1KDUWyUjPUA5kjLic7xCRXD:IwfKDUWzTUA5k6G4D

    Score
    10/10
    neshtaaspackv2discoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks