General

  • Target

    JaffaCakes118_f202fbf598459241748dc6188a9ce4d3

  • Size

    269KB

  • Sample

    250213-w1p93s1nfr

  • MD5

    f202fbf598459241748dc6188a9ce4d3

  • SHA1

    2bd14cc26fe9f4d19313c785166b239be76afbc7

  • SHA256

    94306cae4632b1d6c2cf41e9daf59d0a55b864bae9d2b587c68f3e3184b73af1

  • SHA512

    7b6041fa320871b9381de39d455184137aa05c8654179d1aa0cb57dc5678596b8b8105a58aa2afc6362000201bbe681a368a9e2eeb01f1f43f4fdad50a42e236

  • SSDEEP

    3072:hAn6oNA5f/hK9eb+iY86PLJ83pBw0q6FjctDuFbIbXuUZayuNmhofrwr2LDDHyt2:hA6aAv+5iYPEzF0ZZay/ofrwr0DDHC2n

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_f202fbf598459241748dc6188a9ce4d3

    • Size

      269KB

    • MD5

      f202fbf598459241748dc6188a9ce4d3

    • SHA1

      2bd14cc26fe9f4d19313c785166b239be76afbc7

    • SHA256

      94306cae4632b1d6c2cf41e9daf59d0a55b864bae9d2b587c68f3e3184b73af1

    • SHA512

      7b6041fa320871b9381de39d455184137aa05c8654179d1aa0cb57dc5678596b8b8105a58aa2afc6362000201bbe681a368a9e2eeb01f1f43f4fdad50a42e236

    • SSDEEP

      3072:hAn6oNA5f/hK9eb+iY86PLJ83pBw0q6FjctDuFbIbXuUZayuNmhofrwr2LDDHyt2:hA6aAv+5iYPEzF0ZZay/ofrwr0DDHC2n

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks