General

  • Target

    JaffaCakes118_fc642b52f11f7857eb4620e8f03add8b

  • Size

    246KB

  • Sample

    250215-zq7yxstrbx

  • MD5

    fc642b52f11f7857eb4620e8f03add8b

  • SHA1

    60d8792f98c93a635cfcc4aee9b6193ed2539310

  • SHA256

    00e35387efbeebf214bfb3cf993a1e431e35fb3a41f8700865e0106972ff0a55

  • SHA512

    36e4b228ae6d2cb60d8ba479e111fbd533dd4cf31dfa9fd31a6a1af5248184abe470ede1f61f325748a810f4ddc905f85915f252be51a0f43396274e537f2631

  • SSDEEP

    6144:o+5oGLScwpDXfwjhWQCqSt3ZIXMBygVxYN7T7:oUDED4jhc3ZIXM5Vx+T7

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_fc642b52f11f7857eb4620e8f03add8b

    • Size

      246KB

    • MD5

      fc642b52f11f7857eb4620e8f03add8b

    • SHA1

      60d8792f98c93a635cfcc4aee9b6193ed2539310

    • SHA256

      00e35387efbeebf214bfb3cf993a1e431e35fb3a41f8700865e0106972ff0a55

    • SHA512

      36e4b228ae6d2cb60d8ba479e111fbd533dd4cf31dfa9fd31a6a1af5248184abe470ede1f61f325748a810f4ddc905f85915f252be51a0f43396274e537f2631

    • SSDEEP

      6144:o+5oGLScwpDXfwjhWQCqSt3ZIXMBygVxYN7T7:oUDED4jhc3ZIXM5Vx+T7

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks