General

  • Target

    JaffaCakes118_c7d6d9900db07113abe05692434cd90c

  • Size

    257KB

  • Sample

    250421-fkaaxsvqw5

  • MD5

    c7d6d9900db07113abe05692434cd90c

  • SHA1

    67349368f6e3c690dee4f77080dfe7694573cff0

  • SHA256

    4155e3d5006f95776a92466ba64ca7811cefdff4cb8b7aadecf754ea59c213a3

  • SHA512

    9cbcb4e66f810534c26c11dc8df7e3fac8a2402675bc505bd01c616ba65ff3ae6265b78c86a35b87162ef5b10617baaeb1efdc3e3ea3d0c2c1121607b4b6a44b

  • SSDEEP

    6144:EgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:Y9C3N2ZIUl4/njr8B2Yz

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_c7d6d9900db07113abe05692434cd90c

    • Size

      257KB

    • MD5

      c7d6d9900db07113abe05692434cd90c

    • SHA1

      67349368f6e3c690dee4f77080dfe7694573cff0

    • SHA256

      4155e3d5006f95776a92466ba64ca7811cefdff4cb8b7aadecf754ea59c213a3

    • SHA512

      9cbcb4e66f810534c26c11dc8df7e3fac8a2402675bc505bd01c616ba65ff3ae6265b78c86a35b87162ef5b10617baaeb1efdc3e3ea3d0c2c1121607b4b6a44b

    • SSDEEP

      6144:EgiD9CmFlaRUdduv9sZIUlfxryHfvau9hHoyrnETB2ebz:Y9C3N2ZIUl4/njr8B2Yz

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks