Overview

overview

10

Static

static

3

JaffaCakes...83.exe

windows7-x64

10

JaffaCakes...83.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7d0c19a7a914e296bc74205c2be6e283

  • Size

    227KB

  • Sample

    250202-p69scavkfm

  • MD5

    7d0c19a7a914e296bc74205c2be6e283

  • SHA1

    01205cd24e96a22ae55d951b8f4b22fb88884e24

  • SHA256

    52d514125a71b944c968f0fb0ecc77fdbcc118984662a8364eb29ade6dbdf6a7

  • SHA512

    1d514549ab6ef1fa098a51424a3d64ff48e221395059dd98ef54f336ac4480eac83b0f53f6a0b4995154af0554da443ee777306fd710e66a048f597ffa423d58

  • SSDEEP

    3072:zr8WDrCae8Yco9+qol6WpJ/HAUXnz2z/jM+nz2z/jMq:Pu1+SWPIfz/Kz/9

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      JaffaCakes118_7d0c19a7a914e296bc74205c2be6e283

    • Size

      227KB

    • MD5

      7d0c19a7a914e296bc74205c2be6e283

    • SHA1

      01205cd24e96a22ae55d951b8f4b22fb88884e24

    • SHA256

      52d514125a71b944c968f0fb0ecc77fdbcc118984662a8364eb29ade6dbdf6a7

    • SHA512

      1d514549ab6ef1fa098a51424a3d64ff48e221395059dd98ef54f336ac4480eac83b0f53f6a0b4995154af0554da443ee777306fd710e66a048f597ffa423d58

    • SSDEEP

      3072:zr8WDrCae8Yco9+qol6WpJ/HAUXnz2z/jM+nz2z/jMq:Pu1+SWPIfz/Kz/9

    Score
    10/10
    neshtadiscoverypersistencespywarestealer

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Neshta family

      neshta

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks