General

  • Target

    JaffaCakes118_fed539626163fe3518c8a82798ed8f07

  • Size

    262KB

  • Sample

    250216-deqdvayqdx

  • MD5

    fed539626163fe3518c8a82798ed8f07

  • SHA1

    043dfa39389ee910320b2545685bee1cccc7b3f5

  • SHA256

    d9a08ede25ec13cf3700f5966465fb9fc492534570069a4287fcc293f89596f2

  • SHA512

    f825f84f9fa4fa87f3af194e3d3b1be799670a0bc650bdbed91e778700fa349b09bad69dc1f7ea54aedec9fc5b66a6d07b16baa2d38ed1afb3304f5224fcc37c

  • SSDEEP

    3072:j8nW6fb/CH1pGLP7c7pJ1GE7am88d5Bt9pTlNg8pPD4Cqykp/v35aYV1kOOkSCWc:sWQ6HWLs+Eum1RNrkCqddcGRW4P

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_fed539626163fe3518c8a82798ed8f07

    • Size

      262KB

    • MD5

      fed539626163fe3518c8a82798ed8f07

    • SHA1

      043dfa39389ee910320b2545685bee1cccc7b3f5

    • SHA256

      d9a08ede25ec13cf3700f5966465fb9fc492534570069a4287fcc293f89596f2

    • SHA512

      f825f84f9fa4fa87f3af194e3d3b1be799670a0bc650bdbed91e778700fa349b09bad69dc1f7ea54aedec9fc5b66a6d07b16baa2d38ed1afb3304f5224fcc37c

    • SSDEEP

      3072:j8nW6fb/CH1pGLP7c7pJ1GE7am88d5Bt9pTlNg8pPD4Cqykp/v35aYV1kOOkSCWc:sWQ6HWLs+Eum1RNrkCqddcGRW4P

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Downloads MZ/PE file

    • Adds Run key to start application

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks