neshta

General

Target

12b289b1907ae9f9f865637abbbf486a_JaffaCakes118
Size

415KB
Sample

241004-k1x45szcnf
MD5

12b289b1907ae9f9f865637abbbf486a
SHA1

a96ec3a92fc9757d6e1f0ec645786708be6a1066
SHA256

9964442579aeab5b35a004aeaf739d065549d3f0fa7151df89b29588b245d2f1
SHA512

4521e90e06a4e9e5921be425e67ef3cdf20c4ec826c0655466265ea08c504b7fcc9ed436e8908e952a082411623a1cd4b6cc2447cd3a50676895a6348c0d46cf
SSDEEP

12288:rP88z4yBU/3qO5yx1rGrAt5OCHjgC0cF:Y8fBa+KTGjm

Score

10^/10

Malware Config

Targets

- Target
  
  12b289b1907ae9f9f865637abbbf486a_JaffaCakes118
- Size
  
  415KB
- MD5
  
  12b289b1907ae9f9f865637abbbf486a
- SHA1
  
  a96ec3a92fc9757d6e1f0ec645786708be6a1066
- SHA256
  
  9964442579aeab5b35a004aeaf739d065549d3f0fa7151df89b29588b245d2f1
- SHA512
  
  4521e90e06a4e9e5921be425e67ef3cdf20c4ec826c0655466265ea08c504b7fcc9ed436e8908e952a082411623a1cd4b6cc2447cd3a50676895a6348c0d46cf
- SSDEEP
  
  12288:rP88z4yBU/3qO5yx1rGrAt5OCHjgC0cF:Y8fBa+KTGjm
Score

10^/10

neshta discovery persistence spyware stealer upx
- Detect Neshta payload
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2