General

  • Target

    e1de2e4ca880f759661c76aa69718004_JaffaCakes118

  • Size

    282KB

  • Sample

    240915-g1g65szdmj

  • MD5

    e1de2e4ca880f759661c76aa69718004

  • SHA1

    cce9aae5dd3b58928ea62b41c8bba0a23bc68194

  • SHA256

    73affd0889c255ad79e3b3b2b9eea5911f64b59e4418477ff60dbfa61d195309

  • SHA512

    1d686f4c5f9f224ee48208f3131e0e4e3da1de9bf873d61f53b9472a6542177812e77e0b720dd52f1f9e6be7b88cda5de5a9491632b2219e0b6e45ee86a27f76

  • SSDEEP

    6144:WZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:aFTxWYMh5qoLb8LCy9E

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      e1de2e4ca880f759661c76aa69718004_JaffaCakes118

    • Size

      282KB

    • MD5

      e1de2e4ca880f759661c76aa69718004

    • SHA1

      cce9aae5dd3b58928ea62b41c8bba0a23bc68194

    • SHA256

      73affd0889c255ad79e3b3b2b9eea5911f64b59e4418477ff60dbfa61d195309

    • SHA512

      1d686f4c5f9f224ee48208f3131e0e4e3da1de9bf873d61f53b9472a6542177812e77e0b720dd52f1f9e6be7b88cda5de5a9491632b2219e0b6e45ee86a27f76

    • SSDEEP

      6144:WZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:aFTxWYMh5qoLb8LCy9E

    • Modifies WinLogon for persistence

    • simda

      Simda is an infostealer written in C++.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies WinLogon

MITRE ATT&CK Enterprise v15

Tasks