Overview

overview

10

Static

static

10

2fbd4ed536...18.exe

windows7-x64

10

2fbd4ed536...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fbd4ed5366090a51094bea682bfbc80_JaffaCakes118

  • Size

    149KB

  • Sample

    241009-mt3r6a1fjr

  • MD5

    2fbd4ed5366090a51094bea682bfbc80

  • SHA1

    c11872efbeca71c564b1415e9f27f377ce8afabc

  • SHA256

    efa46df4890fa3376b7a222646883438230ff62600f95e627c1b272eedd7337c

  • SHA512

    f05e1f0b7b85f58332a146dada25433b844c31c4d641d97f2e37c50c85490dde13a2298362669a8c2a69e2496c9e1fcbe37463aeb03eff73a9bd9446d77ff5e5

  • SSDEEP

    3072:sr85CwhPPPV7XmhKyHjV4kAES4qz3xtkDB:k9wPPPhXejykAzC

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      2fbd4ed5366090a51094bea682bfbc80_JaffaCakes118

    • Size

      149KB

    • MD5

      2fbd4ed5366090a51094bea682bfbc80

    • SHA1

      c11872efbeca71c564b1415e9f27f377ce8afabc

    • SHA256

      efa46df4890fa3376b7a222646883438230ff62600f95e627c1b272eedd7337c

    • SHA512

      f05e1f0b7b85f58332a146dada25433b844c31c4d641d97f2e37c50c85490dde13a2298362669a8c2a69e2496c9e1fcbe37463aeb03eff73a9bd9446d77ff5e5

    • SSDEEP

      3072:sr85CwhPPPV7XmhKyHjV4kAES4qz3xtkDB:k9wPPPhXejykAzC

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks