Extracted

• • Target

    18ace9212d0af0d550b6b8f7c9a1884a_JaffaCakes118

  • Size

    1.1MB

  • MD5

    18ace9212d0af0d550b6b8f7c9a1884a

  • SHA1

    ce4dbed0628feb68ad54d48ca1ea66571dbc7d50

  • SHA256

    1e4477ca2d8f7cdf3e3c31dfe6aea10b3986141d33db29e74d61e51abf3e69fd

  • SHA512

    85c45a6db4085f6f8a9ea1649c1d72c03fc517ad64694ca348befb5ab4dbb1b061a5bc15059431b985886f96618c94ce83f25f9d5b15356d9c9aa794c220f7f9

  • SSDEEP

    24576:wk/AT4ghJhZyCBAqPdXkZ945twISis688Oq4P8AnPLedRaFsGaJCYbZsigDJxrPk:BoT4ghXZyCBDFkAT9SisR8j4P8SkaCHO

  Score

  10^/10

  ardamaxdiscoveryevasionkeyloggerpersistencestealertrojan

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax main executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2