Extracted

• • Target

    fd7db905ab900759fa495e8bf037c3e4_JaffaCakes118

  • Size

    380KB

  • MD5

    fd7db905ab900759fa495e8bf037c3e4

  • SHA1

    5ff36850290b1cfe38465534e7455a0b207bff78

  • SHA256

    6547177b230c2b33c7f699afbee2a11a08e7201d94c93621e51f75c8780534e7

  • SHA512

    b49a33e54a9674ab0a8ab2bfe3d4609a15c8481aa4605c61d611f1aa688768636596b82a0897f3e2204b8425fdaa1412f1a9e2832d58fe1d464d354c843d494c

  • SSDEEP

    6144:s9eh7r3r9panVwDnCZYnjiCb1VMoQz95t6TknxqbtkMQGb1/QH1:R7DMoQz954TkopkMQGbKV

  Score

  10^/10

  neshtanjratxxxmrmo0menxxxdiscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2