General

  • Target

    JaffaCakes118_bb60a1d51dfbf33974fe7c455e6ff619

  • Size

    284KB

  • Sample

    250207-zpnhwsyjgj

  • MD5

    bb60a1d51dfbf33974fe7c455e6ff619

  • SHA1

    00d93330271aef67c68bdc87db26ec910e2743f2

  • SHA256

    8065a1b774df7efcd7269f9801426c50456c64a55b32c5a3a815c913e590cb6d

  • SHA512

    2d5168699833858869967ef0446d0cf5c185be334e387061e27ec62b33d011d5db47ead3376a94b8488187e7f942cfd03fc0d248b01b43d7d885f5c0a812bc1b

  • SSDEEP

    6144:SrkONgf/I/wKkYYOpKZNxOy4BAq7qWDqSPSAxuArt/UDpQ0woccckcE1r5cccpXf:SrlG/gwipKkylqGlSavAh/+Q0woccckc

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_bb60a1d51dfbf33974fe7c455e6ff619

    • Size

      284KB

    • MD5

      bb60a1d51dfbf33974fe7c455e6ff619

    • SHA1

      00d93330271aef67c68bdc87db26ec910e2743f2

    • SHA256

      8065a1b774df7efcd7269f9801426c50456c64a55b32c5a3a815c913e590cb6d

    • SHA512

      2d5168699833858869967ef0446d0cf5c185be334e387061e27ec62b33d011d5db47ead3376a94b8488187e7f942cfd03fc0d248b01b43d7d885f5c0a812bc1b

    • SSDEEP

      6144:SrkONgf/I/wKkYYOpKZNxOy4BAq7qWDqSPSAxuArt/UDpQ0woccckcE1r5cccpXf:SrlG/gwipKkylqGlSavAh/+Q0woccckc

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks