General

  • Target

    ea877f03b9e50adc61361d3339ecb214_JaffaCakes118

  • Size

    245KB

  • Sample

    240919-ecyg4szaqh

  • MD5

    ea877f03b9e50adc61361d3339ecb214

  • SHA1

    7ea84413c3dd6df2f45431e678329eb3e22d883a

  • SHA256

    af945e962e133674bc7db1f3f7235263c80790c95cb8f7e8a8223c1e0b192548

  • SHA512

    840526308c9f5dc46f8947d496321e386e9eecc66063a1ea3054c472f93116b763c6d1c38738d9dd02ccd624381feff8f4967d732dd1b6a702a06cd7acb8faf8

  • SSDEEP

    6144:RsjZltXb8wwCdVuEqWpp2Blxo7ZupVIjJAYVcgfjytmRCNbWaRR:RshhwCdpquEguPIOYJLytmw42

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      ea877f03b9e50adc61361d3339ecb214_JaffaCakes118

    • Size

      245KB

    • MD5

      ea877f03b9e50adc61361d3339ecb214

    • SHA1

      7ea84413c3dd6df2f45431e678329eb3e22d883a

    • SHA256

      af945e962e133674bc7db1f3f7235263c80790c95cb8f7e8a8223c1e0b192548

    • SHA512

      840526308c9f5dc46f8947d496321e386e9eecc66063a1ea3054c472f93116b763c6d1c38738d9dd02ccd624381feff8f4967d732dd1b6a702a06cd7acb8faf8

    • SSDEEP

      6144:RsjZltXb8wwCdVuEqWpp2Blxo7ZupVIjJAYVcgfjytmRCNbWaRR:RshhwCdpquEguPIOYJLytmw42

    • Modifies WinLogon for persistence

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies WinLogon

MITRE ATT&CK Enterprise v15

Tasks