General

  • Target

    JaffaCakes118_ecb730880a402ed732a18f6fa2c5eb35

  • Size

    270KB

  • Sample

    250212-dzesvaxrak

  • MD5

    ecb730880a402ed732a18f6fa2c5eb35

  • SHA1

    8084e95a78316258b7cf013a1614598e1221eec1

  • SHA256

    599ba3bfba04c95a8be1b1eca6ca00815ee05b55cd51321e0887d4b6ecd3046a

  • SHA512

    41d6ee0b86248a6188abd293d3a975a33e480977ee82fea203357b944577cfff779e5fd79995ab682cb0b196622aa5313c6bfdc16d0b6c28496a1b8571b8b96b

  • SSDEEP

    6144:us+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:vHMwm9AHebVKkdrH5eyr

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_ecb730880a402ed732a18f6fa2c5eb35

    • Size

      270KB

    • MD5

      ecb730880a402ed732a18f6fa2c5eb35

    • SHA1

      8084e95a78316258b7cf013a1614598e1221eec1

    • SHA256

      599ba3bfba04c95a8be1b1eca6ca00815ee05b55cd51321e0887d4b6ecd3046a

    • SHA512

      41d6ee0b86248a6188abd293d3a975a33e480977ee82fea203357b944577cfff779e5fd79995ab682cb0b196622aa5313c6bfdc16d0b6c28496a1b8571b8b96b

    • SSDEEP

      6144:us+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:vHMwm9AHebVKkdrH5eyr

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks