General

  • Target
    JaffaCakes118_3a35ace6eb05446699663c3af6b85e09
  • Size 270KB
  • Sample251218-16w22avpet
  • SHA256 5ad51d8d689c6bada4aea44eddad1e0c136423eb129117cd506c1b19a24bd0ba
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target
      JaffaCakes118_3a35ace6eb05446699663c3af6b85e09
    • Size 270KB
    • SHA256 5ad51d8d689c6bada4aea44eddad1e0c136423eb129117cd506c1b19a24bd0ba
    • MD5 SHA1 SHA512 SSDEEP
    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks