General

  • Target

    JaffaCakes118_d893e3400456152d057d3b88a5bf3c58

  • Size

    246KB

  • Sample

    250210-hsmx4atlen

  • MD5

    d893e3400456152d057d3b88a5bf3c58

  • SHA1

    aa12f7d16ca4ca595869b9ee7223a0e9435b7e5c

  • SHA256

    c45dadfe89f55ab44096d06138de35c3c4da2a18882b7563b4944f86b60cbfb4

  • SHA512

    141899410534f1913e40387967ec7cf13cf3d2c561c5f86627d38b2117915eae4c34a7e1ef9566982fa08588118cdd2db1b9d6d3b815dcba577fdbbe6c789d5a

  • SSDEEP

    6144:0Cu21vYmFPDTI6eWPeBoNtbu7UQeyXIaYLD+5wUa9ZZdJ4V7mn:0k1vY0vJeagiA1xXIa2DSIZaYn

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_d893e3400456152d057d3b88a5bf3c58

    • Size

      246KB

    • MD5

      d893e3400456152d057d3b88a5bf3c58

    • SHA1

      aa12f7d16ca4ca595869b9ee7223a0e9435b7e5c

    • SHA256

      c45dadfe89f55ab44096d06138de35c3c4da2a18882b7563b4944f86b60cbfb4

    • SHA512

      141899410534f1913e40387967ec7cf13cf3d2c561c5f86627d38b2117915eae4c34a7e1ef9566982fa08588118cdd2db1b9d6d3b815dcba577fdbbe6c789d5a

    • SSDEEP

      6144:0Cu21vYmFPDTI6eWPeBoNtbu7UQeyXIaYLD+5wUa9ZZdJ4V7mn:0k1vY0vJeagiA1xXIa2DSIZaYn

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks