General

  • Target

    JaffaCakes118_f0e9b3529943f87927fceb023884d1b1

  • Size

    266KB

  • Sample

    250212-rj3rmavna1

  • MD5

    f0e9b3529943f87927fceb023884d1b1

  • SHA1

    51bac0f6a569d3579933214641eb9b9293f06463

  • SHA256

    cd161d0c6063a660be6cf30549df81ead3e6ba156287cd8fa8caddcee445b47c

  • SHA512

    e21f6e4080588cf84644b8cf8615551de8245252bfa806207d84e44be7d72298653de9d23ede87c2652b66572b9eb6ef4b10f5c4bdb8cee3a22e15f4e160be43

  • SSDEEP

    6144:ep/jck02ek7v8VjWHJll+s/EyZ+2Wv52AFovNH/mLkGu:I/jJ02r7qWplOk+OAF8NOLK

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_f0e9b3529943f87927fceb023884d1b1

    • Size

      266KB

    • MD5

      f0e9b3529943f87927fceb023884d1b1

    • SHA1

      51bac0f6a569d3579933214641eb9b9293f06463

    • SHA256

      cd161d0c6063a660be6cf30549df81ead3e6ba156287cd8fa8caddcee445b47c

    • SHA512

      e21f6e4080588cf84644b8cf8615551de8245252bfa806207d84e44be7d72298653de9d23ede87c2652b66572b9eb6ef4b10f5c4bdb8cee3a22e15f4e160be43

    • SSDEEP

      6144:ep/jck02ek7v8VjWHJll+s/EyZ+2Wv52AFovNH/mLkGu:I/jJ02r7qWplOk+OAF8NOLK

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks