Overview

overview

10

Static

static

3

f141189e53...18.exe

windows7-x64

10

f141189e53...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f141189e5399f7017ddccb9819399d6d_JaffaCakes118

  • Size

    2.1MB

  • Sample

    240415-rkt6waae7s

  • MD5

    f141189e5399f7017ddccb9819399d6d

  • SHA1

    895b3e076487b92d550de926b147b19474d55ea8

  • SHA256

    d63de465624796397a0aa147400f7e12c2ab0d5edca384cbd9b424c8b0a02e16

  • SHA512

    f5e2bd12688d83e4ed0d377548022a088fc5dae6b29f2888c0155dc62b310f2f628eaacf5e2c1bc0413f1c93ec23083ef62286fa2b5ba9af83b12810470d04a0

  • SSDEEP

    49152:SY3jbmFa55o8HIxSm7+JWrERE/67pBDvo:SYzaFiH6Su+Jf66jA

Score
10/10
ardamaxkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      f141189e5399f7017ddccb9819399d6d_JaffaCakes118

    • Size

      2.1MB

    • MD5

      f141189e5399f7017ddccb9819399d6d

    • SHA1

      895b3e076487b92d550de926b147b19474d55ea8

    • SHA256

      d63de465624796397a0aa147400f7e12c2ab0d5edca384cbd9b424c8b0a02e16

    • SHA512

      f5e2bd12688d83e4ed0d377548022a088fc5dae6b29f2888c0155dc62b310f2f628eaacf5e2c1bc0413f1c93ec23083ef62286fa2b5ba9af83b12810470d04a0

    • SSDEEP

      49152:SY3jbmFa55o8HIxSm7+JWrERE/67pBDvo:SYzaFiH6Su+Jf66jA

    Score
    10/10
    ardamaxkeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks