General

  • Target

    JaffaCakes118_f0446b9cd64828cbf7c9b4263b9fe226

  • Size

    274KB

  • Sample

    250212-pl2k8s1mgz

  • MD5

    f0446b9cd64828cbf7c9b4263b9fe226

  • SHA1

    13f76158d72bdf44be1da65f474652b9ead7d502

  • SHA256

    646a37503368872a06bfaf95772b01ecd6b405c75f65921ec4689e6108dc196e

  • SHA512

    9603ac89b09bc883889615d0d93ea5e5762cfea670af6951e8b94042dd6dddd6cf193599e80582a9d1c1a1f22dba45dea092c7ceb679cfa3d248d03b24e13a3f

  • SSDEEP

    6144:CtCVllPYdJTKU7lHMAyqXWKhQersJRfhv15wmEleKc:CtCVllGXlHMnqmPerKfv+mseKc

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_f0446b9cd64828cbf7c9b4263b9fe226

    • Size

      274KB

    • MD5

      f0446b9cd64828cbf7c9b4263b9fe226

    • SHA1

      13f76158d72bdf44be1da65f474652b9ead7d502

    • SHA256

      646a37503368872a06bfaf95772b01ecd6b405c75f65921ec4689e6108dc196e

    • SHA512

      9603ac89b09bc883889615d0d93ea5e5762cfea670af6951e8b94042dd6dddd6cf193599e80582a9d1c1a1f22dba45dea092c7ceb679cfa3d248d03b24e13a3f

    • SSDEEP

      6144:CtCVllPYdJTKU7lHMAyqXWKhQersJRfhv15wmEleKc:CtCVllGXlHMnqmPerKfv+mseKc

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks