General

  • Target

    JaffaCakes118_f33a8203d2809ca4166f89458b1c407b

  • Size

    274KB

  • Sample

    250214-ed1c4a1rgw

  • MD5

    f33a8203d2809ca4166f89458b1c407b

  • SHA1

    e03c150c6f455743f61341f4bed2ddb81954b5aa

  • SHA256

    b3741f2c7eae66c05e9bdcd0268e9ad0a33f105bf10398255db57db7f524bb3f

  • SHA512

    a10fc5afd1f3aa734029da65d869fbb0028f0b10e1714e622638642c519f6d374daeb6d96aa9bc43044a48bae626a1706d351d6a0d9a6592f81aaf1fae72d3d9

  • SSDEEP

    6144:CtCVllPYdJTKU7lHMAyqXWKhQersJRfhv15wmEleKc:CtCVllGXlHMnqmPerKfv+mseKc

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_f33a8203d2809ca4166f89458b1c407b

    • Size

      274KB

    • MD5

      f33a8203d2809ca4166f89458b1c407b

    • SHA1

      e03c150c6f455743f61341f4bed2ddb81954b5aa

    • SHA256

      b3741f2c7eae66c05e9bdcd0268e9ad0a33f105bf10398255db57db7f524bb3f

    • SHA512

      a10fc5afd1f3aa734029da65d869fbb0028f0b10e1714e622638642c519f6d374daeb6d96aa9bc43044a48bae626a1706d351d6a0d9a6592f81aaf1fae72d3d9

    • SSDEEP

      6144:CtCVllPYdJTKU7lHMAyqXWKhQersJRfhv15wmEleKc:CtCVllGXlHMnqmPerKfv+mseKc

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks