Overview

overview

10

Static

static

3

676cc53b7a...18.exe

windows7-x64

10

676cc53b7a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    676cc53b7a5a82fae31a378d21a81bb5_JaffaCakes118

  • Size

    13.2MB

  • Sample

    241021-z1sxrayfnn

  • MD5

    676cc53b7a5a82fae31a378d21a81bb5

  • SHA1

    e29470049a2a57409990e9b8d6c84f59f915647a

  • SHA256

    44e8a04b410256c9201da884a6582771e0c0394729f85ac6a7cc1ae96a4ab8fa

  • SHA512

    745b80524c2a2bb829e5aff480ef27c777b8d13848f08c3764a4b7a7468c46417094bd571b73987e364ee19ed0eacd27610d724f130de2d136c91540059e5800

  • SSDEEP

    393216:5wk1j7BMh3WP+vBXKvPcZe9DGHpld97fapVZBX:vfBMh3Z0M6OlWpVZBX

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      676cc53b7a5a82fae31a378d21a81bb5_JaffaCakes118

    • Size

      13.2MB

    • MD5

      676cc53b7a5a82fae31a378d21a81bb5

    • SHA1

      e29470049a2a57409990e9b8d6c84f59f915647a

    • SHA256

      44e8a04b410256c9201da884a6582771e0c0394729f85ac6a7cc1ae96a4ab8fa

    • SHA512

      745b80524c2a2bb829e5aff480ef27c777b8d13848f08c3764a4b7a7468c46417094bd571b73987e364ee19ed0eacd27610d724f130de2d136c91540059e5800

    • SSDEEP

      393216:5wk1j7BMh3WP+vBXKvPcZe9DGHpld97fapVZBX:vfBMh3Z0M6OlWpVZBX

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks