General

  • Target

    JaffaCakes118_fd1ac113ea504d58054d2d285cfc498e

  • Size

    268KB

  • Sample

    250215-2ndy6symes

  • MD5

    fd1ac113ea504d58054d2d285cfc498e

  • SHA1

    f5d568bc90dbd9dde5eada1c84f1b4cbbf68db60

  • SHA256

    6e917a0bfd0543e70ec875a0d319bbe40a8253c5f93b2d6a45c366b16e4bf0fb

  • SHA512

    b70fd070f0673439cabfb21d77780e6a78214c947838fffcd3d09fff889a4fa481f1225c142cf755e81757318c051172a678d3848b860a29eca4a2f805286f95

  • SSDEEP

    6144:v5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:rATkKbbxI9CEHFJzCCsCfYWivpvN20T

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_fd1ac113ea504d58054d2d285cfc498e

    • Size

      268KB

    • MD5

      fd1ac113ea504d58054d2d285cfc498e

    • SHA1

      f5d568bc90dbd9dde5eada1c84f1b4cbbf68db60

    • SHA256

      6e917a0bfd0543e70ec875a0d319bbe40a8253c5f93b2d6a45c366b16e4bf0fb

    • SHA512

      b70fd070f0673439cabfb21d77780e6a78214c947838fffcd3d09fff889a4fa481f1225c142cf755e81757318c051172a678d3848b860a29eca4a2f805286f95

    • SSDEEP

      6144:v5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:rATkKbbxI9CEHFJzCCsCfYWivpvN20T

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks