General

  • Target

    JaffaCakes118_e9d21b45d7a34d1851f609d5f20892c8

  • Size

    262KB

  • Sample

    250211-yrcnqsyphs

  • MD5

    e9d21b45d7a34d1851f609d5f20892c8

  • SHA1

    46b794697ba1ab8d868c72a3b4c3d2821f749cb5

  • SHA256

    d9a2c5a9303d2239f8ad576fd2314dc7121f58ab0e527f629534449b2bfc8a5e

  • SHA512

    57e02ec3e4af5bc5855ba4d1457c1e78c42e73e1a0d7186e365b9ec5750213cadd243da1c0286da492c97e2054ad36a71873ce860ca19700931bb319459609f4

  • SSDEEP

    3072:A8nW6fb/CH1pGLP7c7pJ1GE7am88d5Bt9pTlNg8pPD4Cqykp/v35aYV1kOOkSCWc:LWQ6HWLs+Eum1RNrkCqddcGRW4P

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_e9d21b45d7a34d1851f609d5f20892c8

    • Size

      262KB

    • MD5

      e9d21b45d7a34d1851f609d5f20892c8

    • SHA1

      46b794697ba1ab8d868c72a3b4c3d2821f749cb5

    • SHA256

      d9a2c5a9303d2239f8ad576fd2314dc7121f58ab0e527f629534449b2bfc8a5e

    • SHA512

      57e02ec3e4af5bc5855ba4d1457c1e78c42e73e1a0d7186e365b9ec5750213cadd243da1c0286da492c97e2054ad36a71873ce860ca19700931bb319459609f4

    • SSDEEP

      3072:A8nW6fb/CH1pGLP7c7pJ1GE7am88d5Bt9pTlNg8pPD4Cqykp/v35aYV1kOOkSCWc:LWQ6HWLs+Eum1RNrkCqddcGRW4P

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks