General

  • Target

    JaffaCakes118_c5be92b26b7263f6cea1f6141f325f17

  • Size

    250KB

  • Sample

    250420-nl4j6axlt2

  • MD5

    c5be92b26b7263f6cea1f6141f325f17

  • SHA1

    b7847f933e574c272c1fc3d5f5a9e39a8373bdcb

  • SHA256

    175570f54325e5d215572d5cea1e973a6bbcccd3d976b41c6c8bb73eb62d3ba4

  • SHA512

    40ff624bf1478139e1190d8f39c1dad3aa20810a23350491d35b679447d9b713b1ca13e88e0cb461260ded6593b3594fdbd3a51e2e6824192287e8757c9a1bc3

  • SSDEEP

    3072:ZGOFLomQsQtM25LSF12LT8nsQqIbSC3IzSNGOsDGLCpIfMhlGV6T3A/tROoHniXb:HXxQtJ2FSBYr3gOrEhdT3A/tROoHLQ

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_c5be92b26b7263f6cea1f6141f325f17

    • Size

      250KB

    • MD5

      c5be92b26b7263f6cea1f6141f325f17

    • SHA1

      b7847f933e574c272c1fc3d5f5a9e39a8373bdcb

    • SHA256

      175570f54325e5d215572d5cea1e973a6bbcccd3d976b41c6c8bb73eb62d3ba4

    • SHA512

      40ff624bf1478139e1190d8f39c1dad3aa20810a23350491d35b679447d9b713b1ca13e88e0cb461260ded6593b3594fdbd3a51e2e6824192287e8757c9a1bc3

    • SSDEEP

      3072:ZGOFLomQsQtM25LSF12LT8nsQqIbSC3IzSNGOsDGLCpIfMhlGV6T3A/tROoHniXb:HXxQtJ2FSBYr3gOrEhdT3A/tROoHLQ

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks