Extracted

• • Target

    57557ca4418c0bebbbaa138b08bec836_JaffaCakes118

  • Size

    1.0MB

  • MD5

    57557ca4418c0bebbbaa138b08bec836

  • SHA1

    122c9f7b78577dfb8aefd49616d2a951afa6200f

  • SHA256

    bf0fff255c43216e317706afeb542580b1ad1b4bc2c7b00733eed5c80ba007ec

  • SHA512

    5636338761699e6f227ab2b1335e0ce955635ef0423302a5e00d592fa989b0e326145147530ea9adc8587d5714da7e40f28bca499f928cccca4e4fa1b4f2f4c4

  • SSDEEP

    1536:JxqjQ+P04wsmJC1Qf6XSRfpBXUroNXXCLh0DYw3xaiS378xWNF2KF+RIwR3:sr85C166XSLBNXI0Qn8xWXrF+93

  Score

  10^/10

  neshtadiscoverypersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2