General

  • Target

    JaffaCakes118_e983e7b9e6d848397029c2b2d73b7fcc

  • Size

    257KB

  • Sample

    250211-x1qfhsykdy

  • MD5

    e983e7b9e6d848397029c2b2d73b7fcc

  • SHA1

    b0f257d55001ae86c8032a9f9cac8612377c91c4

  • SHA256

    c48bfce49ba64436860fc58a821d165a6696ae76dbcf409a986119a94d0d6688

  • SHA512

    c67285178adbb2fe92509c7e778e1bbb224a3a0885975a0f55a0ac3de34a4c124fce69a129b569d9521680fca1a5f5cd4ba65304239b977942817b84ae83be0b

  • SSDEEP

    6144:dgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:n9C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_e983e7b9e6d848397029c2b2d73b7fcc

    • Size

      257KB

    • MD5

      e983e7b9e6d848397029c2b2d73b7fcc

    • SHA1

      b0f257d55001ae86c8032a9f9cac8612377c91c4

    • SHA256

      c48bfce49ba64436860fc58a821d165a6696ae76dbcf409a986119a94d0d6688

    • SHA512

      c67285178adbb2fe92509c7e778e1bbb224a3a0885975a0f55a0ac3de34a4c124fce69a129b569d9521680fca1a5f5cd4ba65304239b977942817b84ae83be0b

    • SSDEEP

      6144:dgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:n9C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks