Overview

overview

10

Static

static

3

65eb79c58b...b9.exe

windows7-x64

10

65eb79c58b...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_02142a4d9034cefeb3ddef2f367a02cd03e379ce29dcb5e82153662a113b8fc5

  • Size

    549KB

  • Sample

    241226-3t5vhsvqc1

  • MD5

    2eea151b93d6c8fb5154d88a159749b9

  • SHA1

    aa232ecefc3dd22c49ce79a4206c3b539622d38d

  • SHA256

    02142a4d9034cefeb3ddef2f367a02cd03e379ce29dcb5e82153662a113b8fc5

  • SHA512

    90da1a16c0848d04af9f611d08b2b34bb7d1e0f7b29cc4c3a1ffb8310301647d423381576d600f829825633395f595f7cc6deea9b7c8f17741563bfb7e02af31

  • SSDEEP

    12288:omsUd2WxkSsS+gIcqV8vXCWRlQqAw2UVQwxU:luWD+gI9HWRlQy2UPxU

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      65eb79c58bfddacebc3d72fc220f5b4a9fbcebda917d5d55f7621dcf2f95b0b9

    • Size

      603KB

    • MD5

      9314f1ff84e2de4d7a3051a47c320761

    • SHA1

      e25f22c6897cf8badc1836cd088688b1ed602586

    • SHA256

      65eb79c58bfddacebc3d72fc220f5b4a9fbcebda917d5d55f7621dcf2f95b0b9

    • SHA512

      10f1394779afc25b66e4c16cc05d1242b7ebed756c0c957e5638915b6fbbb17b4297a1652a53d89fd1b04c7f1cd4f474c49aa118e97236288d00407e819becee

    • SSDEEP

      12288:/NHbufgD7qSdPBZ4SpLeLBLg12sgLkLORn3U07DzDCNEl2xdjta33q+Q0:/5Cfgas/LpLeLBDsgTG077CNElqjY33J

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks