General

  • Target

    JaffaCakes118_eca7dfb279e5c00da66c9dca7a001af5

  • Size

    257KB

  • Sample

    250212-drpyvaxrat

  • MD5

    eca7dfb279e5c00da66c9dca7a001af5

  • SHA1

    0e03d32b263e5bf30ba227d1a29f1afe4a07b852

  • SHA256

    a2ce585c87ff7c0ca594de18ba0f46e5f65be6f71632d9a8633b4246982913bd

  • SHA512

    9d6a32de346290999cf1b78d135c0da25b7cf44b69eff9199c0ce5c28613e0ae8b35727f46758a67cde53a86021c73d218b1f9edc972c07ebd4c78f8bb50b94c

  • SSDEEP

    6144:/giD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:d9C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_eca7dfb279e5c00da66c9dca7a001af5

    • Size

      257KB

    • MD5

      eca7dfb279e5c00da66c9dca7a001af5

    • SHA1

      0e03d32b263e5bf30ba227d1a29f1afe4a07b852

    • SHA256

      a2ce585c87ff7c0ca594de18ba0f46e5f65be6f71632d9a8633b4246982913bd

    • SHA512

      9d6a32de346290999cf1b78d135c0da25b7cf44b69eff9199c0ce5c28613e0ae8b35727f46758a67cde53a86021c73d218b1f9edc972c07ebd4c78f8bb50b94c

    • SSDEEP

      6144:/giD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:d9C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks