General

  • Target

    JaffaCakes118_c05e976468103a05d5cc2700a218de3e

  • Size

    282KB

  • Sample

    250419-agehks1qx9

  • MD5

    c05e976468103a05d5cc2700a218de3e

  • SHA1

    f568d2343dc35ea126ac670ddfd687dbd7678aee

  • SHA256

    d1e0f244fdf7434575b6f85deaf29694bb8e312cafd0879f132853895a4f3ad6

  • SHA512

    d471617a11204b0278c8dd73d860c9a86c8cfce2016cf3094d517e7c2fd6a3bf5b90f8b6e982057a3a7b5a106efef73238a157fee5b35e6bd7a9e7bef19008ea

  • SSDEEP

    6144:qZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:eFTxWYMh5qoLb8LCy9E

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_c05e976468103a05d5cc2700a218de3e

    • Size

      282KB

    • MD5

      c05e976468103a05d5cc2700a218de3e

    • SHA1

      f568d2343dc35ea126ac670ddfd687dbd7678aee

    • SHA256

      d1e0f244fdf7434575b6f85deaf29694bb8e312cafd0879f132853895a4f3ad6

    • SHA512

      d471617a11204b0278c8dd73d860c9a86c8cfce2016cf3094d517e7c2fd6a3bf5b90f8b6e982057a3a7b5a106efef73238a157fee5b35e6bd7a9e7bef19008ea

    • SSDEEP

      6144:qZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:eFTxWYMh5qoLb8LCy9E

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks