General

  • Target

    9b85f96f09f71227797fba0ed73051bdefccf6bd3a029a06ec7aec552da26581.exe

  • Size

    282KB

  • Sample

    250217-j4vmrawqbr

  • MD5

    635bb56353d749a3f4b9067ee3af53b6

  • SHA1

    ef3188a9c3fa65e2fd1d1dfb9051adabbcc2a50b

  • SHA256

    9b85f96f09f71227797fba0ed73051bdefccf6bd3a029a06ec7aec552da26581

  • SHA512

    e5168bc052bdd1ca736d8eaf1e75c4298a384520a97a80c44d26b99d24ac21efbd2cb26bd4fbda04789c91edf6feedcedd747e64f99b99932bc8afa5adb2bc0e

  • SSDEEP

    6144:XZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF10:JFTxWYMh5qoLb8LCy9c

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      9b85f96f09f71227797fba0ed73051bdefccf6bd3a029a06ec7aec552da26581.exe

    • Size

      282KB

    • MD5

      635bb56353d749a3f4b9067ee3af53b6

    • SHA1

      ef3188a9c3fa65e2fd1d1dfb9051adabbcc2a50b

    • SHA256

      9b85f96f09f71227797fba0ed73051bdefccf6bd3a029a06ec7aec552da26581

    • SHA512

      e5168bc052bdd1ca736d8eaf1e75c4298a384520a97a80c44d26b99d24ac21efbd2cb26bd4fbda04789c91edf6feedcedd747e64f99b99932bc8afa5adb2bc0e

    • SSDEEP

      6144:XZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF10:JFTxWYMh5qoLb8LCy9c

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks