Overview

overview

10

Static

static

3

1fbcdc7c26...18.exe

windows7-x64

10

1fbcdc7c26...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1fbcdc7c265ed7789f0405ceba5f40b4_JaffaCakes118

  • Size

    40KB

  • Sample

    240702-sdh1psxgkb

  • MD5

    1fbcdc7c265ed7789f0405ceba5f40b4

  • SHA1

    7e27ef9d15edb59daa30168b39e3f39a64854de6

  • SHA256

    1e53ad52ef6b3a1fca0ff11d9eb16890fe08f41928a257d785300ab556109cfa

  • SHA512

    80483b40a35615b76d950842f3b96ddd5681de2f70bf52c2997ea6f335d5ac379a3768b2503335d49ac293b5148878a19a519260183d89689815f370e8f8ee82

  • SSDEEP

    768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJtOqVt:yxqjQ+P04wsZLnDrCL

Score
10/10
neshtapersistencespywarestealer

Malware Config

Targets

    • Target

      1fbcdc7c265ed7789f0405ceba5f40b4_JaffaCakes118

    • Size

      40KB

    • MD5

      1fbcdc7c265ed7789f0405ceba5f40b4

    • SHA1

      7e27ef9d15edb59daa30168b39e3f39a64854de6

    • SHA256

      1e53ad52ef6b3a1fca0ff11d9eb16890fe08f41928a257d785300ab556109cfa

    • SHA512

      80483b40a35615b76d950842f3b96ddd5681de2f70bf52c2997ea6f335d5ac379a3768b2503335d49ac293b5148878a19a519260183d89689815f370e8f8ee82

    • SSDEEP

      768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJtOqVt:yxqjQ+P04wsZLnDrCL

    Score
    10/10
    neshtapersistencespywarestealer

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks