General

  • Target

    JaffaCakes118_e85b3594ce638ff4a027cc7baecf1bfa

  • Size

    259KB

  • Sample

    250211-vbypgstmfy

  • MD5

    e85b3594ce638ff4a027cc7baecf1bfa

  • SHA1

    cb8ff1b8722a819aed670d2a4edb97ea03a97c65

  • SHA256

    a36d6ebaf2797f68e6e8bbde6b4acc7ba6d8780ed4519057ffafcf149b4f4bcb

  • SHA512

    c2ca5f8fb9862fa1ab3b86d63a03f3ceff9d9b10c6d44eb6b8bc7bc2d0d08e2a9d16632498979c87f5e4d5561e17d8fcbded6ef141e252ec14b936604e03839f

  • SSDEEP

    6144:iyK4+vW9EnkxPWu9oYUkZYeLoerbZP4sdA9hmEPpW5rpH:FK99kPWqBU0LDrNgsdA9hFPW9

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_e85b3594ce638ff4a027cc7baecf1bfa

    • Size

      259KB

    • MD5

      e85b3594ce638ff4a027cc7baecf1bfa

    • SHA1

      cb8ff1b8722a819aed670d2a4edb97ea03a97c65

    • SHA256

      a36d6ebaf2797f68e6e8bbde6b4acc7ba6d8780ed4519057ffafcf149b4f4bcb

    • SHA512

      c2ca5f8fb9862fa1ab3b86d63a03f3ceff9d9b10c6d44eb6b8bc7bc2d0d08e2a9d16632498979c87f5e4d5561e17d8fcbded6ef141e252ec14b936604e03839f

    • SSDEEP

      6144:iyK4+vW9EnkxPWu9oYUkZYeLoerbZP4sdA9hmEPpW5rpH:FK99kPWqBU0LDrNgsdA9hFPW9

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks