General

  • Target

    JaffaCakes118_c31c5f35bbce711cd2d1c360484f8bb3

  • Size

    284KB

  • Sample

    250419-scz8la1rz2

  • MD5

    c31c5f35bbce711cd2d1c360484f8bb3

  • SHA1

    30fd5c3667d68ddbfadfb0ac23de6c7f23ae65d4

  • SHA256

    2be704e4c9e8f11590744938caac5f7868b88dd864d3f02d6ea1c49c485ab9c4

  • SHA512

    88edd40595e8d9e56c7b67b21d81e92e9a80ce76d8056a133a5b6f03bb9e90fe8a6220a4704fa320ed2a7527fd44b151a2d33b8affa1439544b6e98d5763988b

  • SSDEEP

    6144:xrkONgf/I/wKkYYOpKZNxOy4BAq7qWDqSPSAxuArt/UDpQ0woccckcE1r5cccpXf:xrlG/gwipKkylqGlSavAh/+Q0woccckc

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_c31c5f35bbce711cd2d1c360484f8bb3

    • Size

      284KB

    • MD5

      c31c5f35bbce711cd2d1c360484f8bb3

    • SHA1

      30fd5c3667d68ddbfadfb0ac23de6c7f23ae65d4

    • SHA256

      2be704e4c9e8f11590744938caac5f7868b88dd864d3f02d6ea1c49c485ab9c4

    • SHA512

      88edd40595e8d9e56c7b67b21d81e92e9a80ce76d8056a133a5b6f03bb9e90fe8a6220a4704fa320ed2a7527fd44b151a2d33b8affa1439544b6e98d5763988b

    • SSDEEP

      6144:xrkONgf/I/wKkYYOpKZNxOy4BAq7qWDqSPSAxuArt/UDpQ0woccckcE1r5cccpXf:xrlG/gwipKkylqGlSavAh/+Q0woccckc

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks