General

  • Target

    JaffaCakes118_541ffe7e887aff14310335da2ea44bb0

  • Size

    464KB

  • Sample

    250101-n362lswphk

  • MD5

    541ffe7e887aff14310335da2ea44bb0

  • SHA1

    9472e1c3a7bbb37c8ccf5e3712b0c13b05b249f2

  • SHA256

    072f4d7b2ccc56358f85cc18b28cb76fe8009981a1ad67c0440c76112fd92003

  • SHA512

    c93a5a3b5437f1b68d1129dd2d6b86fbde7ba336b52ced51e52c565bab737b3f3addf8dc7400c41542f8d6f9e0fa8e9d2ab67075e29ce7973a2c4b520f87f3c2

  • SSDEEP

    12288:eFwxMOArfNmUu5gmqYHSNyTdBIpo04G84w7AeRX:665gmqYyg5b

Malware Config

Targets

    • Target

      JaffaCakes118_541ffe7e887aff14310335da2ea44bb0

    • Size

      464KB

    • MD5

      541ffe7e887aff14310335da2ea44bb0

    • SHA1

      9472e1c3a7bbb37c8ccf5e3712b0c13b05b249f2

    • SHA256

      072f4d7b2ccc56358f85cc18b28cb76fe8009981a1ad67c0440c76112fd92003

    • SHA512

      c93a5a3b5437f1b68d1129dd2d6b86fbde7ba336b52ced51e52c565bab737b3f3addf8dc7400c41542f8d6f9e0fa8e9d2ab67075e29ce7973a2c4b520f87f3c2

    • SSDEEP

      12288:eFwxMOArfNmUu5gmqYHSNyTdBIpo04G84w7AeRX:665gmqYyg5b

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks