General

  • Target

    JaffaCakes118_c10694867a912a060c0e83ed046cb6a8

  • Size

    257KB

  • Sample

    250419-dstnesvrx7

  • MD5

    c10694867a912a060c0e83ed046cb6a8

  • SHA1

    81e95ce7205eeef5b1650ce13e7ae4942582f283

  • SHA256

    1d129e175d877981749db881da3a25b8d5a55a2071b4c6c339828390712571ef

  • SHA512

    869af0dbb2af1e1d1ef5ccfcdd2327dac8891ea5a4689f0be4376a7d906661e22196646e24eb955ac18d956600a3b437c9fdf429fb2fd931e05bcd0c6e29f17c

  • SSDEEP

    6144:UgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:o9C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_c10694867a912a060c0e83ed046cb6a8

    • Size

      257KB

    • MD5

      c10694867a912a060c0e83ed046cb6a8

    • SHA1

      81e95ce7205eeef5b1650ce13e7ae4942582f283

    • SHA256

      1d129e175d877981749db881da3a25b8d5a55a2071b4c6c339828390712571ef

    • SHA512

      869af0dbb2af1e1d1ef5ccfcdd2327dac8891ea5a4689f0be4376a7d906661e22196646e24eb955ac18d956600a3b437c9fdf429fb2fd931e05bcd0c6e29f17c

    • SSDEEP

      6144:UgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:o9C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks