General

  • Target

    JaffaCakes118_bf10d8c20665b9cc32db9ea5a40541ce

  • Size

    268KB

  • Sample

    250418-v3xaqssry9

  • MD5

    bf10d8c20665b9cc32db9ea5a40541ce

  • SHA1

    fa391426b4207e7d395ec59cbda10e7ca5bbf8ba

  • SHA256

    037d38b1af1120268553a2070db9637f2cad70354863ffe6399717a16cbbbe45

  • SHA512

    7538858bd4dec9da6fb0f69a23492942143d961f850f258f45fd47e549f9eebaf7c3d53487abaead741a9bd433a30c1e3467b442750bba252933c59c14e6a88b

  • SSDEEP

    6144:m5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:CATkKbbxI9CEHFJzCCsCfYWivpvN20T

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_bf10d8c20665b9cc32db9ea5a40541ce

    • Size

      268KB

    • MD5

      bf10d8c20665b9cc32db9ea5a40541ce

    • SHA1

      fa391426b4207e7d395ec59cbda10e7ca5bbf8ba

    • SHA256

      037d38b1af1120268553a2070db9637f2cad70354863ffe6399717a16cbbbe45

    • SHA512

      7538858bd4dec9da6fb0f69a23492942143d961f850f258f45fd47e549f9eebaf7c3d53487abaead741a9bd433a30c1e3467b442750bba252933c59c14e6a88b

    • SSDEEP

      6144:m5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:CATkKbbxI9CEHFJzCCsCfYWivpvN20T

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks