General

  • Target

    JaffaCakes118_c8e9b39a8d3006649ece601c623580cc

  • Size

    262KB

  • Sample

    250209-adjywsymcx

  • MD5

    c8e9b39a8d3006649ece601c623580cc

  • SHA1

    efbbabfcc34967e78d0a064df7c79ceeadf25f4e

  • SHA256

    fd3616d786acdeaa91e96008e2c20b36aa86bc65f9e56cd02f2f907bb593650f

  • SHA512

    27e7d29d768a5a91836c93d4d5617a104b6216727b3a30b90cb4b6fdc04cafebfb3a6c5822b88905271c82e35a0022fc987cd0955cc2ffc09db086b9d2ca045f

  • SSDEEP

    6144:0+YWuHvzUjwIX4/K9qyngFaslvi2yCNpqFDOtIgb8HnnBykzaU9SKZ+b:VYWuHvQj1X+K9qyngFasl6fJ5NIkzj9K

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_c8e9b39a8d3006649ece601c623580cc

    • Size

      262KB

    • MD5

      c8e9b39a8d3006649ece601c623580cc

    • SHA1

      efbbabfcc34967e78d0a064df7c79ceeadf25f4e

    • SHA256

      fd3616d786acdeaa91e96008e2c20b36aa86bc65f9e56cd02f2f907bb593650f

    • SHA512

      27e7d29d768a5a91836c93d4d5617a104b6216727b3a30b90cb4b6fdc04cafebfb3a6c5822b88905271c82e35a0022fc987cd0955cc2ffc09db086b9d2ca045f

    • SSDEEP

      6144:0+YWuHvzUjwIX4/K9qyngFaslvi2yCNpqFDOtIgb8HnnBykzaU9SKZ+b:VYWuHvQj1X+K9qyngFasl6fJ5NIkzj9K

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks