General

  • Target

    JaffaCakes118_ebc6acd2af8403d4f14371d0f0765a81

  • Size

    257KB

  • Sample

    250212-bjlv4swkhp

  • MD5

    ebc6acd2af8403d4f14371d0f0765a81

  • SHA1

    3524ab0c2542370559bec2640a7574b0655dcaa6

  • SHA256

    d2e539d20c1d580e52f2b8d84eef5a842f82609952832ae2cd9dccded98b2480

  • SHA512

    0bdcd26fc645fbc858d288d6dc253ebde98032e08e255c05435b5ab3a2a4d3edc2a839c0438c6dd62a556f2272d3ca21446d5166bd4824d3804120e942003bde

  • SSDEEP

    6144:RgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:j9C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_ebc6acd2af8403d4f14371d0f0765a81

    • Size

      257KB

    • MD5

      ebc6acd2af8403d4f14371d0f0765a81

    • SHA1

      3524ab0c2542370559bec2640a7574b0655dcaa6

    • SHA256

      d2e539d20c1d580e52f2b8d84eef5a842f82609952832ae2cd9dccded98b2480

    • SHA512

      0bdcd26fc645fbc858d288d6dc253ebde98032e08e255c05435b5ab3a2a4d3edc2a839c0438c6dd62a556f2272d3ca21446d5166bd4824d3804120e942003bde

    • SSDEEP

      6144:RgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:j9C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks