General

  • Target

    f603994fb0185c94f642349bed2d6db2_JaffaCakes118

  • Size

    246KB

  • Sample

    240925-pmvt3svflj

  • MD5

    f603994fb0185c94f642349bed2d6db2

  • SHA1

    c71530595a6d0d5d3df05ef2b306602877d58106

  • SHA256

    0634d03217fa824e12e831f1e3ceb731f0eca9f9f4b8aca9c6cfd396c7b02a73

  • SHA512

    02097b5ca6a769c26671605a2b8615485c504260d215ab330b41a135b50dabb348c4de4ff95dd1c3506ce0ec6e7cc3613ae4b68b354e9b80b4d4f4d584c257e8

  • SSDEEP

    6144:dCu21vYmFPDTI6eWPeBoNtbu7UQeyXIaYLD+5wUa9ZZdJ4V7mn:dk1vY0vJeagiA1xXIa2DSIZaYn

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      f603994fb0185c94f642349bed2d6db2_JaffaCakes118

    • Size

      246KB

    • MD5

      f603994fb0185c94f642349bed2d6db2

    • SHA1

      c71530595a6d0d5d3df05ef2b306602877d58106

    • SHA256

      0634d03217fa824e12e831f1e3ceb731f0eca9f9f4b8aca9c6cfd396c7b02a73

    • SHA512

      02097b5ca6a769c26671605a2b8615485c504260d215ab330b41a135b50dabb348c4de4ff95dd1c3506ce0ec6e7cc3613ae4b68b354e9b80b4d4f4d584c257e8

    • SSDEEP

      6144:dCu21vYmFPDTI6eWPeBoNtbu7UQeyXIaYLD+5wUa9ZZdJ4V7mn:dk1vY0vJeagiA1xXIa2DSIZaYn

    • Modifies WinLogon for persistence

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies WinLogon

MITRE ATT&CK Enterprise v15

Tasks