General

  • Target

    JaffaCakes118_c166543d584d5480f120ec11dfa550e1

  • Size

    282KB

  • Sample

    250419-fxar8awsbv

  • MD5

    c166543d584d5480f120ec11dfa550e1

  • SHA1

    f5238c8869c3e15e9d50c0ca5dea79aa92e533bf

  • SHA256

    ac45896f0efe6c3901976cb2f2a5fa32d1133fe6696a2b5e3575264c37a764ff

  • SHA512

    cd0070fd01ca9a341217e3101f55fb910000c0628e6479ee223f5fad3527e073ed8960bf4aeb6b73b93056ada83f3756ffeb1c028aa50f851cd111b42717c1d1

  • SSDEEP

    6144:XZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:JFTxWYMh5qoLb8LCy9E

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_c166543d584d5480f120ec11dfa550e1

    • Size

      282KB

    • MD5

      c166543d584d5480f120ec11dfa550e1

    • SHA1

      f5238c8869c3e15e9d50c0ca5dea79aa92e533bf

    • SHA256

      ac45896f0efe6c3901976cb2f2a5fa32d1133fe6696a2b5e3575264c37a764ff

    • SHA512

      cd0070fd01ca9a341217e3101f55fb910000c0628e6479ee223f5fad3527e073ed8960bf4aeb6b73b93056ada83f3756ffeb1c028aa50f851cd111b42717c1d1

    • SSDEEP

      6144:XZw2TxWX/f48zO7gtwua+Japo5iCb8lseuxw/6YF1M:JFTxWYMh5qoLb8LCy9E

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks