General

  • Target

    JaffaCakes118_6bd7550f4d76995224b7305467badecc

  • Size

    122KB

  • Sample

    250131-tnza4ssndp

  • MD5

    6bd7550f4d76995224b7305467badecc

  • SHA1

    e441400e7f90846924d11da8097a2edfabdd47b5

  • SHA256

    e77179a59e0a8587dd261e06bf410536c93ad38f6d68a9f8ef334c30c58710b8

  • SHA512

    eea4e4811cb2f884913fc03e13b20efa0c4dbeacde26b78467c1e7b460b090718eb7c229471f754fe7f654db03bfd85693ba06dc78ed4d69d96089f289de9c70

  • SSDEEP

    3072:Cr8WDrCz70tRjmjoShmCL+r2p1e/X/2hmn2woB13Dz:KuEtRWoShmULe/0Y23Bz

Malware Config

Targets

    • Target

      JaffaCakes118_6bd7550f4d76995224b7305467badecc

    • Size

      122KB

    • MD5

      6bd7550f4d76995224b7305467badecc

    • SHA1

      e441400e7f90846924d11da8097a2edfabdd47b5

    • SHA256

      e77179a59e0a8587dd261e06bf410536c93ad38f6d68a9f8ef334c30c58710b8

    • SHA512

      eea4e4811cb2f884913fc03e13b20efa0c4dbeacde26b78467c1e7b460b090718eb7c229471f754fe7f654db03bfd85693ba06dc78ed4d69d96089f289de9c70

    • SSDEEP

      3072:Cr8WDrCz70tRjmjoShmCL+r2p1e/X/2hmn2woB13Dz:KuEtRWoShmULe/0Y23Bz

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks