General

  • Target

    JaffaCakes118_bab889a0c02777868def992d4e27e2e2

  • Size

    270KB

  • Sample

    250207-yc9d6avrdk

  • MD5

    bab889a0c02777868def992d4e27e2e2

  • SHA1

    0785752416249d8ee55a81ac28b1eafe014ac857

  • SHA256

    a82628a3bdeb7c7384fecf4872ff1614a10c0e514c79e66d5d1d067768fea6ef

  • SHA512

    7687bb9f8063034e20f1d246e4ec06dc4b55c3ecc71e827bdced8ef028e6d875457c9b4a88997b8084f04d84cea2bfd12e67bce2b2ca92568baedcafa3dc506f

  • SSDEEP

    6144:vs+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:UHMwm9AHebVKkdrH5eyr

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_bab889a0c02777868def992d4e27e2e2

    • Size

      270KB

    • MD5

      bab889a0c02777868def992d4e27e2e2

    • SHA1

      0785752416249d8ee55a81ac28b1eafe014ac857

    • SHA256

      a82628a3bdeb7c7384fecf4872ff1614a10c0e514c79e66d5d1d067768fea6ef

    • SHA512

      7687bb9f8063034e20f1d246e4ec06dc4b55c3ecc71e827bdced8ef028e6d875457c9b4a88997b8084f04d84cea2bfd12e67bce2b2ca92568baedcafa3dc506f

    • SSDEEP

      6144:vs+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:UHMwm9AHebVKkdrH5eyr

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks