Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
20/02/2025, 11:19
General
-
Target
JaffaCakes118_0b88e94ae9dd8dee30fecd56c6e5b33a.exe
-
Size
244KB
-
MD5
0b88e94ae9dd8dee30fecd56c6e5b33a
-
SHA1
ee1e76c898ff0398caa0c19a12d8b3495f2256fd
-
SHA256
3a72f497e776f886f0389b096c439a99bc632383eb6b3064ea2f5cb46b3809df
-
SHA512
b09c0e12dc7478785b0058f79bccb9a57c38a9b76ae3c16f61d724e6ac4134996042b47a12d6f675ce9659097235cee70d05147fc826175004a43090a901ed84
-
SSDEEP
6144:tPIJKqp6HEwqrBaIRv06ScY12EpOKfeyWBzd4TK:tPI0qw56sIRpS2KOKfetBB4TK
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b88e94ae9dd8dee30fecd56c6e5b33a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b88e94ae9dd8dee30fecd56c6e5b33a.exe"1⤵
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5c4547933eb13db269ec625e68561a78b
SHA1e27cbdf6aa207587304a5415568c8619a1efa02e
SHA2561b05e58aeac7485f552fb277802b8a04d91648f67d80a371d711d97c423ad115
SHA512f052ca184311ac406e20b9a5b434676e259ef035376d44645e9d3dc95667b966a18ced1e1ca6e89dda76b633854376390b076b8264bd8e24ff9a33251e388e6c
-
Filesize
1KB
MD5caf27a5da0884ddefca1c1b6ab4fe483
SHA1346a0d1ecc6e45ed27df8b37bcdf3bffa040fbf5
SHA256f8dd55d12c889e72344c50ddd4f4d4e7439bd7e0c81df308892c0fd66d5e55c1
SHA512148e515efb8c4ad1dcff6e868ff4876874c6c6c1d0533d01196d48345c1c8cb986be439c95d4b53355a5e847a2a82b1d6c5816f71b90e466c419eb8d9d26485e
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1.3MB
-
Filesize
352KB
-
Filesize
400KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
1.3MB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
352KB
-
Filesize
400KB