General

  • Target

    ea76df33d8557b7833d810c46344a576_JaffaCakes118

  • Size

    255KB

  • Sample

    240919-dhxx4axena

  • MD5

    ea76df33d8557b7833d810c46344a576

  • SHA1

    2e07e8931f5964699aaa47e48959aee1bc27a92b

  • SHA256

    12568218a1fba2b84ea57a42528207a4401a5d350217748636138f1ab92ab7af

  • SHA512

    8a27460db8d5be31332b09db4200241f074c5fe2f2d7f03e9ee27cd966273c61325b6655b2ec2ce823b7da3a39e0cae3f1695e267819ff28ee4979d25f0240f5

  • SSDEEP

    6144:bNU2+2kcTBWUZxjCld3hRV2QsXSAaj4ijpFaQTQisa:bNRdpgdRRoTCD4ijpoix

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      ea76df33d8557b7833d810c46344a576_JaffaCakes118

    • Size

      255KB

    • MD5

      ea76df33d8557b7833d810c46344a576

    • SHA1

      2e07e8931f5964699aaa47e48959aee1bc27a92b

    • SHA256

      12568218a1fba2b84ea57a42528207a4401a5d350217748636138f1ab92ab7af

    • SHA512

      8a27460db8d5be31332b09db4200241f074c5fe2f2d7f03e9ee27cd966273c61325b6655b2ec2ce823b7da3a39e0cae3f1695e267819ff28ee4979d25f0240f5

    • SSDEEP

      6144:bNU2+2kcTBWUZxjCld3hRV2QsXSAaj4ijpFaQTQisa:bNRdpgdRRoTCD4ijpoix

    • Modifies WinLogon for persistence

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies WinLogon

MITRE ATT&CK Enterprise v15

Tasks