General

  • Target

    JaffaCakes118_baaa7cb2d68d49b808ee40d975370eb0

  • Size

    257KB

  • Sample

    250207-yabecatqhw

  • MD5

    baaa7cb2d68d49b808ee40d975370eb0

  • SHA1

    382cac354dcdf585968114bac0860b33df9cbee8

  • SHA256

    7963fbdf170998daa13c80ce45d64cfbe6381fe5e89e7054955dd4285bbb9bf0

  • SHA512

    b2eb60561fbb3340e1d1b239f46b115d3dce264bf876fec997582ca072995ded4ddedc4ab4a0e24a7cad2e82bc9939ad2321c9aecbd798b28d439150db32029f

  • SSDEEP

    6144:ogiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:E9C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_baaa7cb2d68d49b808ee40d975370eb0

    • Size

      257KB

    • MD5

      baaa7cb2d68d49b808ee40d975370eb0

    • SHA1

      382cac354dcdf585968114bac0860b33df9cbee8

    • SHA256

      7963fbdf170998daa13c80ce45d64cfbe6381fe5e89e7054955dd4285bbb9bf0

    • SHA512

      b2eb60561fbb3340e1d1b239f46b115d3dce264bf876fec997582ca072995ded4ddedc4ab4a0e24a7cad2e82bc9939ad2321c9aecbd798b28d439150db32029f

    • SSDEEP

      6144:ogiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:E9C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks