General

  • Target

    JaffaCakes118_fcb9ed75c6a576031dd1da2d56a08fd7

  • Size

    270KB

  • Sample

    250215-1ns8eswncw

  • MD5

    fcb9ed75c6a576031dd1da2d56a08fd7

  • SHA1

    3fce6669633b03a8a72fd5c290c167c9a59c2b36

  • SHA256

    8153a226dfe5a25da8c3d0ef17dab0b8345dbba78d0b10e9d4227f181005e40f

  • SHA512

    ceacf7c637f70664a2ee6f43ec531994b40fa462dc362fd270b16b790c4a41269f91da217972652c2f382f745357d91aa381f5e391cc6fc0cf1fd8fbfc4df9ed

  • SSDEEP

    6144:is+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:rHMwm9AHebVKkdrH5eyr

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_fcb9ed75c6a576031dd1da2d56a08fd7

    • Size

      270KB

    • MD5

      fcb9ed75c6a576031dd1da2d56a08fd7

    • SHA1

      3fce6669633b03a8a72fd5c290c167c9a59c2b36

    • SHA256

      8153a226dfe5a25da8c3d0ef17dab0b8345dbba78d0b10e9d4227f181005e40f

    • SHA512

      ceacf7c637f70664a2ee6f43ec531994b40fa462dc362fd270b16b790c4a41269f91da217972652c2f382f745357d91aa381f5e391cc6fc0cf1fd8fbfc4df9ed

    • SSDEEP

      6144:is+IN9RS6LTa9Ar37L2We1zwYVlEkdqY/nMmS6H5el8BJN:rHMwm9AHebVKkdrH5eyr

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks