General

  • Target

    f9bbe213fe402c8eb7087b192d4a1862_JaffaCakes118

  • Size

    266KB

  • Sample

    240927-fdrxdswbjj

  • MD5

    f9bbe213fe402c8eb7087b192d4a1862

  • SHA1

    09a43d7e37cd7b5dfdd0c3ef483e023cd1e0a137

  • SHA256

    01ac77e670e3a884c66ac406e4324db327ccc540112d5106fe67d4df5cfe5030

  • SHA512

    114767e6be363d7fda93c11115fb7454551ea157787fbb12337bce05cc100ab7e738509dfcec1af3a376432c0fde5995e98458d2a3750da38ae62d7be357de4a

  • SSDEEP

    6144:uLZvT5kuch1RbwHwpmRTamIhUgVZbap1fqFrge4fr51zpTM:Wfch1RPpmRTam4jbaAglnzq

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      f9bbe213fe402c8eb7087b192d4a1862_JaffaCakes118

    • Size

      266KB

    • MD5

      f9bbe213fe402c8eb7087b192d4a1862

    • SHA1

      09a43d7e37cd7b5dfdd0c3ef483e023cd1e0a137

    • SHA256

      01ac77e670e3a884c66ac406e4324db327ccc540112d5106fe67d4df5cfe5030

    • SHA512

      114767e6be363d7fda93c11115fb7454551ea157787fbb12337bce05cc100ab7e738509dfcec1af3a376432c0fde5995e98458d2a3750da38ae62d7be357de4a

    • SSDEEP

      6144:uLZvT5kuch1RbwHwpmRTamIhUgVZbap1fqFrge4fr51zpTM:Wfch1RPpmRTam4jbaAglnzq

    • Modifies WinLogon for persistence

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies WinLogon

MITRE ATT&CK Enterprise v15

Tasks