General

  • Target

    JaffaCakes118_fe55cf3e38c88c5951a74fcf5dff2bc5

  • Size

    268KB

  • Sample

    250216-b4waaavphn

  • MD5

    fe55cf3e38c88c5951a74fcf5dff2bc5

  • SHA1

    22203b58f57a82f4ff6bf1f273672c7b661c1a62

  • SHA256

    45c738c6b884deab50de16a69e4f277e07dbf8552a50b9d9913a5259ec826443

  • SHA512

    45b3c3843160d38b93cd13b062c73de91180ffe71301457ecb3a544ff435d9a39a864bc40d88bfd356c2bdf9e3809a7369ff7accfe9dccfaaf2153c28fe632ae

  • SSDEEP

    6144:Z5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:5ATkKbbxI9CEHFJzCCsCfYWivpvN20T

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_fe55cf3e38c88c5951a74fcf5dff2bc5

    • Size

      268KB

    • MD5

      fe55cf3e38c88c5951a74fcf5dff2bc5

    • SHA1

      22203b58f57a82f4ff6bf1f273672c7b661c1a62

    • SHA256

      45c738c6b884deab50de16a69e4f277e07dbf8552a50b9d9913a5259ec826443

    • SHA512

      45b3c3843160d38b93cd13b062c73de91180ffe71301457ecb3a544ff435d9a39a864bc40d88bfd356c2bdf9e3809a7369ff7accfe9dccfaaf2153c28fe632ae

    • SSDEEP

      6144:Z5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:5ATkKbbxI9CEHFJzCCsCfYWivpvN20T

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks