Extracted

• • Target

    JaffaCakes118_f92359062dc66a57f6ab00e784f1e495

  • Size

    1013KB

  • MD5

    f92359062dc66a57f6ab00e784f1e495

  • SHA1

    4c95214e1399b27d56872d6ec719f6118f12e569

  • SHA256

    13c915b6798a47b5dd873b24b1c276eb5ffb190e62d12efe3d0d6a580eb65da3

  • SHA512

    dce4035fffd6b3a2cdd5f4b5384448339537853defdc3466e039eb4073b6ce07c73b60f7d8b9420afc5a28d215287b8b1caa75b369f460dca0411438f5368c35

  • SSDEEP

    12288:7ng2XY3mqzJFrTjSWPob/0TuvRUpHdc709aWbFUBfo5Tvraiam3xPaqGhE/fjuSm:7g2XY3mqTjMvRUpCA9PTTn3NaBMf

  Score

  10^/10

  neshtadiscoverypersistencespywarestealer

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2