Overview

overview

10

Static

static

3

16ffc38571...18.exe

windows7-x64

10

16ffc38571...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16ffc38571aed91f8b28f3ba6668786d_JaffaCakes118

  • Size

    847KB

  • Sample

    240627-wtgdlatbpe

  • MD5

    16ffc38571aed91f8b28f3ba6668786d

  • SHA1

    01ced7cb8112ed5949ac3b8bfdf78d71f522e918

  • SHA256

    33156750157ee038f21ba0f54dec19bcfc4eb311fdc0c3967c56f7fd09d89192

  • SHA512

    54ad13c62b2f77dcf52335322d2d0a5c995e7dac22e5e6bb250f39853c45aa770a715b0f3f01c4fafe6fa1871db3e0b8345072b0d679a0e1a26b5df0e2d66f9b

  • SSDEEP

    24576:bU6D2MaAIDDMVeudAWuNIiGSDOFfVRTwuUsK:bU6zODMV9dY/Sb/K

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      16ffc38571aed91f8b28f3ba6668786d_JaffaCakes118

    • Size

      847KB

    • MD5

      16ffc38571aed91f8b28f3ba6668786d

    • SHA1

      01ced7cb8112ed5949ac3b8bfdf78d71f522e918

    • SHA256

      33156750157ee038f21ba0f54dec19bcfc4eb311fdc0c3967c56f7fd09d89192

    • SHA512

      54ad13c62b2f77dcf52335322d2d0a5c995e7dac22e5e6bb250f39853c45aa770a715b0f3f01c4fafe6fa1871db3e0b8345072b0d679a0e1a26b5df0e2d66f9b

    • SSDEEP

      24576:bU6D2MaAIDDMVeudAWuNIiGSDOFfVRTwuUsK:bU6zODMV9dY/Sb/K

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks