Overview

overview

10

Static

static

10

e8fae2f950...18.exe

windows7-x64

10

e8fae2f950...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8fae2f950bb7a79457c05d957006392_JaffaCakes118

  • Size

    368KB

  • Sample

    241213-aqqxzasnfx

  • MD5

    e8fae2f950bb7a79457c05d957006392

  • SHA1

    0d4a08392699c268dfcd9bafa1ca8f9e5055feac

  • SHA256

    b4259c0ecf8b473142db1e4425a05528446b07973c706607cb9c37b03c0ff870

  • SHA512

    8949430a3cddee9f67d67aceefe3dadda728e95ce4322ad9baa9ca3b323e32d7476fdfa49c5811f7fe4055c0b8a30ba837f7a914aa91037259bb22e06b98b87e

  • SSDEEP

    6144:k9u3dsbuTWxXJtDBFP9IXBc3/EGrs5O3zdqTLxMS:P3dsbtlYRyXrsizd0LSS

Score
10/10
gozineshtabankerdiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Targets

    • Target

      e8fae2f950bb7a79457c05d957006392_JaffaCakes118

    • Size

      368KB

    • MD5

      e8fae2f950bb7a79457c05d957006392

    • SHA1

      0d4a08392699c268dfcd9bafa1ca8f9e5055feac

    • SHA256

      b4259c0ecf8b473142db1e4425a05528446b07973c706607cb9c37b03c0ff870

    • SHA512

      8949430a3cddee9f67d67aceefe3dadda728e95ce4322ad9baa9ca3b323e32d7476fdfa49c5811f7fe4055c0b8a30ba837f7a914aa91037259bb22e06b98b87e

    • SSDEEP

      6144:k9u3dsbuTWxXJtDBFP9IXBc3/EGrs5O3zdqTLxMS:P3dsbtlYRyXrsizd0LSS

    Score
    10/10
    gozineshtabankerdiscoverypersistenceprivilege_escalationspywarestealertrojan

    • Detect Neshta payload

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Event Triggered Execution: AppCert DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks