Loading malware…
Simda, also known as Shiz and sometimes associated with iBank naming in detections, is a Windows malware family and botnet used by cybercriminal operators since at least 2009. It is best known as an information-stealing threat that also provides remote backdoor access to compromised systems, enabling operators to reroute web traffic, inject or modify website content, harvest credentials and banking-related information, and deploy additional malware. Simda infections were historically widespread, with global botnet activity affecting large numbers of Windows hosts.
Simda has been associated with infections on systems running unpatched software and with a criminal pay-per-install ecosystem. Once established, it can support follow-on payload delivery and broader post-compromise activity through remote control of infected machines. Reporting also describes the malware as stealthy, with backdoor components changing their presence periodically to reduce antivirus detection.
Technically, Simda is notable for use of a domain generation algorithm for command-and-control resilience. Analyses describe generation of large sets of candidate domains based on sample-specific parameters such as key-derived values, domain length, and top-level domain. Simda samples have also used process injection, including DLL injection into the Windows Winlogon process via remote memory writing and remote thread creation, to execute malicious code within legitimate processes and evade defenses.
Simda has been described both as a malware family and as the botnet built from infected hosts under criminal control. Its operators used the resulting access for credential theft, traffic manipulation, malware installation, and resale or leasing of compromised-machine access to other criminals.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Since 2009, cyber criminals have been targeting computers with unpatched software and compromising them with Simda malware.
This malware may re-route a user’s Internet traffic to websites under criminal control...
This particular sample uses Dynamic-Link Library (DLL) injection. This involves writing multiple components of the injection process into the remote process with an API named "WriteProcessMemory" and "CreateRemoteThread". The remote process that will be supplying the code cave is called "Winlogon".
This particular sample uses Dynamic-Link Library (DLL) injection. This involves writing multiple components of the injection process into the remote process with an API named "WriteProcessMemory" and "CreateRemoteThread".
The backdoors also morph their presence every few hours, allowing low anti-virus detection rates and the means for stealthy operation.
This particular sample uses Dynamic-Link Library (DLL) injection. This involves writing multiple components of the injection process into the remote process with an API named "WriteProcessMemory" and "CreateRemoteThread". The remote process that will be supplying the code cave is called "Winlogon".
This particular sample uses Dynamic-Link Library (DLL) injection. This involves writing multiple components of the injection process into the remote process with an API named "WriteProcessMemory" and "CreateRemoteThread".
This malware may re-route a user’s Internet traffic to websites under criminal control...
A system infected with Simda may allow cyber criminals to harvest user credentials, including banking information...
Adversaries may make use of Domain Generation Alogirthms (DGAs) to dynamically identify a destination for command and control traffic rather than relying on a list of static IP addresses or domains.
...or can be used to install additional malware.
This malware may re-route a user’s Internet traffic to websites under criminal control...
The malicious actors control the network of compromised systems (botnet) through backdoors, giving them remote access to carry out additional attacks...
Adversaries may make use of Domain Generation Alogirthms (DGAs) to dynamically identify a destination for command and control traffic rather than relying on a list of static IP addresses or domains.
README.md ... Domain Generation Algorithms (DGAs) of Malware reimplemented in Python.
94 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.