General

  • Target

    JaffaCakes118_e2ea3ed5a59d928e7a9c78734da56f75

  • Size

    257KB

  • Sample

    250211-fv63msxnfk

  • MD5

    e2ea3ed5a59d928e7a9c78734da56f75

  • SHA1

    d164e6b56ae6c459a3000ab96f915ff223badd20

  • SHA256

    c3c880260952dc15e25e538db1f0e970e672936871394723761168e62671b0ca

  • SHA512

    ec38b802668a083bd7fbfc5eb0f9139fdaf21143f7c11ed7fe8562a2ec01198f24e30fc295ab7c4e710d973b3e04245eb4a2a31a7c526de20d47913d6c73a028

  • SSDEEP

    6144:4giD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:U9C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_e2ea3ed5a59d928e7a9c78734da56f75

    • Size

      257KB

    • MD5

      e2ea3ed5a59d928e7a9c78734da56f75

    • SHA1

      d164e6b56ae6c459a3000ab96f915ff223badd20

    • SHA256

      c3c880260952dc15e25e538db1f0e970e672936871394723761168e62671b0ca

    • SHA512

      ec38b802668a083bd7fbfc5eb0f9139fdaf21143f7c11ed7fe8562a2ec01198f24e30fc295ab7c4e710d973b3e04245eb4a2a31a7c526de20d47913d6c73a028

    • SSDEEP

      6144:4giD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:U9C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks