General

  • Target

    JaffaCakes118_c728bfda143e40146042faad2dc80c19

  • Size

    262KB

  • Sample

    250208-zejrystphn

  • MD5

    c728bfda143e40146042faad2dc80c19

  • SHA1

    9d14a1d6d63c2fc726026ab499321d63ade9ddd6

  • SHA256

    bd202157c436c081b90c1ae2c046c8b7a538a4a9ac3dde5e789c73a404a5eb5b

  • SHA512

    3abd6384a60442a9696378ef5cf5023545a165d2b942a01a173f02afce6dd617efefd0eb0fae08fae861511096ec8ab4b503eb1777f28b54e8e5ff8a2e789ee1

  • SSDEEP

    6144:M+YWuHvzUjwIX4/K9qyngFaslvi2yCNpqFDOtIgb8HnnBykzaU9SKZ+b:tYWuHvQj1X+K9qyngFasl6fJ5NIkzj9K

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_c728bfda143e40146042faad2dc80c19

    • Size

      262KB

    • MD5

      c728bfda143e40146042faad2dc80c19

    • SHA1

      9d14a1d6d63c2fc726026ab499321d63ade9ddd6

    • SHA256

      bd202157c436c081b90c1ae2c046c8b7a538a4a9ac3dde5e789c73a404a5eb5b

    • SHA512

      3abd6384a60442a9696378ef5cf5023545a165d2b942a01a173f02afce6dd617efefd0eb0fae08fae861511096ec8ab4b503eb1777f28b54e8e5ff8a2e789ee1

    • SSDEEP

      6144:M+YWuHvzUjwIX4/K9qyngFaslvi2yCNpqFDOtIgb8HnnBykzaU9SKZ+b:tYWuHvQj1X+K9qyngFasl6fJ5NIkzj9K

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks