General

  • Target

    JaffaCakes118_d8a288db55535b0c3940a5b53ae9f73a

  • Size

    282KB

  • Sample

    250210-hxlktsvjdz

  • MD5

    d8a288db55535b0c3940a5b53ae9f73a

  • SHA1

    478e2a3288e4321e0389623b6c10b2ad6bef3eea

  • SHA256

    798d6f9c9b7ea13bd3badbac40d2ea98e724a9b263dfcf7f0b4c4474b92d40d2

  • SHA512

    107d8d69b6cc5f176f70a8c8b72e43092514800f07527b3c828a21798462ec2068fc00533321e00bf264b0e236b0a8bbd944ad342c2a3bfaee92b1bb0be1dfb4

  • SSDEEP

    6144:RZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:bFTxWYMh5qoLb8LCy9E

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_d8a288db55535b0c3940a5b53ae9f73a

    • Size

      282KB

    • MD5

      d8a288db55535b0c3940a5b53ae9f73a

    • SHA1

      478e2a3288e4321e0389623b6c10b2ad6bef3eea

    • SHA256

      798d6f9c9b7ea13bd3badbac40d2ea98e724a9b263dfcf7f0b4c4474b92d40d2

    • SHA512

      107d8d69b6cc5f176f70a8c8b72e43092514800f07527b3c828a21798462ec2068fc00533321e00bf264b0e236b0a8bbd944ad342c2a3bfaee92b1bb0be1dfb4

    • SSDEEP

      6144:RZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:bFTxWYMh5qoLb8LCy9E

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks