General

  • Target

    JaffaCakes118_f305c092cfbc7aba9ced93648148e478

  • Size

    257KB

  • Sample

    250214-dy1c6azqgk

  • MD5

    f305c092cfbc7aba9ced93648148e478

  • SHA1

    ca017660ef0b1b3e92a10cc49e0356982cb58530

  • SHA256

    00cb58d5c7ce69f7393eaee761a6ed267cc411a46b935bf6f6879d46b058c868

  • SHA512

    e659b669b0e782e58afcfc20d4982da1522bb40a30bb8fed66614d0cd6f712c462e27261adf25e6c880835ffef2dd9964a2fb6e893ed97aa8b59c166ff4399df

  • SSDEEP

    6144:JgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:b9C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_f305c092cfbc7aba9ced93648148e478

    • Size

      257KB

    • MD5

      f305c092cfbc7aba9ced93648148e478

    • SHA1

      ca017660ef0b1b3e92a10cc49e0356982cb58530

    • SHA256

      00cb58d5c7ce69f7393eaee761a6ed267cc411a46b935bf6f6879d46b058c868

    • SHA512

      e659b669b0e782e58afcfc20d4982da1522bb40a30bb8fed66614d0cd6f712c462e27261adf25e6c880835ffef2dd9964a2fb6e893ed97aa8b59c166ff4399df

    • SSDEEP

      6144:JgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:b9C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks