General

  • Target

    JaffaCakes118_e6cc3354ad3b67c239e2fa7193b94a0c

  • Size

    257KB

  • Sample

    250211-qq5zwstkfq

  • MD5

    e6cc3354ad3b67c239e2fa7193b94a0c

  • SHA1

    79b5311306779ba1a42a84e023288b57ff87ca71

  • SHA256

    b744dee7368d79ad835bf9880ad3236179517d008524b707536395029795f0c4

  • SHA512

    e8cf072a5e7b91fd346793c619e9def8bfdab80d5a8642cce5844c280a28941b2af914764f7559661c8ab02f59b23c55ddaf78fb05d4ca5aa995d5b127745f46

  • SSDEEP

    6144:YgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:09C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_e6cc3354ad3b67c239e2fa7193b94a0c

    • Size

      257KB

    • MD5

      e6cc3354ad3b67c239e2fa7193b94a0c

    • SHA1

      79b5311306779ba1a42a84e023288b57ff87ca71

    • SHA256

      b744dee7368d79ad835bf9880ad3236179517d008524b707536395029795f0c4

    • SHA512

      e8cf072a5e7b91fd346793c619e9def8bfdab80d5a8642cce5844c280a28941b2af914764f7559661c8ab02f59b23c55ddaf78fb05d4ca5aa995d5b127745f46

    • SSDEEP

      6144:YgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:09C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks