General

  • Target

    JaffaCakes118_d7076625b670ac67c0512e592c89c76c

  • Size

    269KB

  • Sample

    250210-el6vvazpgk

  • MD5

    d7076625b670ac67c0512e592c89c76c

  • SHA1

    287d49fe8cfb5aae32d15e89697b18492e802cb2

  • SHA256

    980840ce40471f41aaced7c06fc43bbe2d21f08f75f9faf7b87210e6b1cb4ce7

  • SHA512

    e7f1683d0444cdba8547bab93714e7d9c1dc74dc95a30ad3b7e4f3026307ed45fffd5b28923c625110488b13e72155205217490d7c6d006fc1a54acfc3edf087

  • SSDEEP

    6144:a/w8abEfC7QCAUtrj89/BskQkWTfZQ0/0cdmiRwxArDUn:a4K6LzHKcvTZQ0/0zJxQDU

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_d7076625b670ac67c0512e592c89c76c

    • Size

      269KB

    • MD5

      d7076625b670ac67c0512e592c89c76c

    • SHA1

      287d49fe8cfb5aae32d15e89697b18492e802cb2

    • SHA256

      980840ce40471f41aaced7c06fc43bbe2d21f08f75f9faf7b87210e6b1cb4ce7

    • SHA512

      e7f1683d0444cdba8547bab93714e7d9c1dc74dc95a30ad3b7e4f3026307ed45fffd5b28923c625110488b13e72155205217490d7c6d006fc1a54acfc3edf087

    • SSDEEP

      6144:a/w8abEfC7QCAUtrj89/BskQkWTfZQ0/0cdmiRwxArDUn:a4K6LzHKcvTZQ0/0zJxQDU

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks