General

  • Target

    JaffaCakes118_d1d6720f1629dc6557b8d4d353e00297

  • Size

    270KB

  • Sample

    250209-v18kzsxrfy

  • MD5

    d1d6720f1629dc6557b8d4d353e00297

  • SHA1

    0882f40d2c111c699ea00efce84b2e130842bfc7

  • SHA256

    7549ff61a5a28bfc3296ac0a99c5b52be7755d3b2a22e973c49ab150cccca4ee

  • SHA512

    263cac8699819b6433382c78bca46371763fc0a9168b5f43c04da42eec154ceacd9c0d0552802e1d8168a263ba86c099fd5701fce343babcf0c782ab1b1c349a

  • SSDEEP

    6144:Cs+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:LHMwm9AHebVKkdrH5eyr

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_d1d6720f1629dc6557b8d4d353e00297

    • Size

      270KB

    • MD5

      d1d6720f1629dc6557b8d4d353e00297

    • SHA1

      0882f40d2c111c699ea00efce84b2e130842bfc7

    • SHA256

      7549ff61a5a28bfc3296ac0a99c5b52be7755d3b2a22e973c49ab150cccca4ee

    • SHA512

      263cac8699819b6433382c78bca46371763fc0a9168b5f43c04da42eec154ceacd9c0d0552802e1d8168a263ba86c099fd5701fce343babcf0c782ab1b1c349a

    • SSDEEP

      6144:Cs+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:LHMwm9AHebVKkdrH5eyr

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks